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ABSTRACT 


This  thesis  will  provide  a  review  and  evaluation  of  the 
internal  control  program  in  the  Department  of  the  Navy. 

Topics  considered  include:   the  evolution  of  the  term 
internal  control  both  in  the  private  and  public  sectors;  the 
theoretical  background  of  R.  N.  Anthony's  planning  and  control 
system  and  his  management  control  process;  the  establishment 
and  review  of  internal  control  systems  within  both  sectors;  and 
illustrative  cases  which  demonstrate  the  inadequacy  of  focus- 
ing on  the  narrow  interpretation  of  internal  accounting  control. 
It  is  the  author's  belief  that  management  control—measures 
employed  by  management  to  reach  its  objectives — is  the  only 
meaningful  framework  within  which  the  subsets  of  administra- 
tive and  accounting  controls  must  be  combined  for  the  effec- 
tive and  efficient  accomplishment  of  the  organization's  objec- 
tives, whether  of  the  public  or  private  sector. 

The  research  consisted  primarily  of  a  detailed  search  and 
evaluation  of  the  literature  in  the  area  of  internal  control 
and  management  control. 
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I.   INTRODUCTION 

A.  PURPOSE 

As  concern  over  the  numerous  cases  of  fraud,  waste,  abuse, 
and  mismanagement  of  programs  has  grown,  new  legal  amendments, 
directives  and  standards  have  been  developed  to  strengthen 
internal  control  systems  in  the  Federal  Government  as  a  prevent- 
ive measure.   There  is  a  critical  need  for  "...  Senior  executive 
Service,  Merit  Pay,  senior  military  equivalents  and  other 
civilian  and  military  employees  with  significant  management 
responsibilities  ..."  [Ref.  1]  to  gain  a  knowledge  and  under- 
standing of  the  concept  of  internal  control  and  their  respon- 
sibilities in  this  area  in  order  to  guide  the  implementation 
of  effective  systems  within  their  organization.   The  purpose 
of  this  thesis  is  to  provide  the  requisite  knowledge  and 
understanding  for  these  Department  of  Defense  (DOD)  managers. 

B.  BACKGROUND 

Despite  the  fact  that  internal  controls  have  not  been  a 
major  management  priority,  the  recognition  of  their  importance 
in  the  Federal  Government  is  not  new.   The  Accounting  and 
Auditing  Act  of  1950  placed  the  responsibility  for  establish- 
ing and  maintaining  adequate  systems  of  internal  control  upon 
the  head  of  each  executive  agency.   The  Act  encompassed  not 
only  systems  of  internal  control  that  provide  full  disclosure 
of  an  agency's  financial  results,  adequate  financial 


information  for  agency  management  purposes,  reliable  accounting 
results  and  suitable  integration  of  agency  accounting  with 
Treasury  Department  accounting,  but  also  systems  of  internal 
control  that  provide  effective  control  over  the  account- 
ability of  all  funds,  property,  and  other  assets  for  which 
the  agency  is  responsible.   Thus,  as  early  as  1950,  the  law 
clearly  indicated  that  proper  systems  of  accounting  and  in- 
ternal control  were  necessary  for  program  and  operational 
activities,  as  well  as  for  financial  and  administrative 
functions . 

Even  so,  the  development  of  effective  systems  has  been 
slow.   Recent  public  disclosures  of  fraud,  waste,  and  abuse, 
and  findings  of  poor  internal  controls  such  as  those  noted  in 
a  study  by  the  U.S.  General  Accounting  Office  (GAO)  have  caused 
concern  among  responsible  federal  officials  and  taxpayers: 

...  the  loss  to  the  Government  on  the  77,000  cases  would 
total  between  $150  and  $220  million.   These  losses  are 
only  what  is  attributable  to  known  fraud  and  other 
illegal  activities  investigated  by  the  Federal  agencies 
in  this  study.   It  does  not  include  . . .  the  cost  of 
undetected  fraud  which  is  probably  much  higher  because 
weak  internal  controls  allow  fraud  to  flourish  . . .  the 
cost  of  fraud  and  illegal  activities  cannot  always  be 
measured  in  dollars  and  cents.   Fraud  erodes  public 
confidence  in  the  Government's  ability  to  efficiently 
and  effectively  manage  its  programs.  [Ref .  2] 

Within  the  last  several  years  increased  attention  has  been 

directed  toward  strengthening  internal  controls  to  prevent 

illegal,  unauthorized,  or  questionable  actions,  to  help  restore 

confidence  in  Government,  and  to  improve  its  operations. 

These,  and  other  developments,  will  be  reviewed. 


C.   SCOPE  AND  METHODOLOGY 

This  thesis  will  provide  a  review  and  evaluation  of  the 
internal  control  program  in  the  Department  of  the  Navy. 

The  evolution  of  the  term  internal  control  will  be  put 
into  perspective  by  presenting  the  development  within  the 
private  sector  and  then  comparing  it  to  the  evolution  of  the 
expression  in  the  public  sector. 

The  theoretical  background  of  R.  N.  Anthony's  Planning  and 
Control  System  and  his  management  control  process  will  be 
reviewed  in  order  to  provide  a  general  structure  within  which 
to  integrate  the  specific  systems  of  internal  control  of  the 
private  and  public  sectors. 

Managers  in  both  sectors  share  the  common  concerns  of 
obtaining  and  utilizing  resources  effectively  and  efficiently 
in  accomplishing  the  objectives  of  their  organizations.   Yet 
the  definitive  literature  concerning  the  subject  of  establish- 
ing and  reviewing  internal  controls  provides  assistance  to 
independent  auditors  in  their  review  of  financial  controls 
and  does  not  address  the  spectrum  of  administrative/  as  well 
as,  accounting  controls  necessary  to  meet  managers' 
requirements.   As  an  assistance,  a  more  comprehensive  method- 
ology for  establishing  an  internal  control  system  which 
emphasizes  program  and  operational  controls,  as  well  as 
financial  and  administrative  ones,  is  presented  for  use  by 
federal  managers. 
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The  internal  accounting  controls  of  the  private  sector 
will  be  integrated  within  Anthony's  management  control  frame- 
work, as  will  DOD's  Planning,  Programming,  and  Budgeting 
System. 

A  number  of  illustrative  cases  will  demonstrate  the 
inadequacy  of  focusing  on  the  narrow  interpretation  of  internal 
accounting  control  when  the  real  intent  is  management  control. 

Finally,  the  conclusion  is  reached  that  management 
control— measures  employed  by  management  to  reach  its 
objectives--is  the  only  meaningful  framework  within  which  the 
subsets  of  administrative  and  accounting  controls  must  be 
combined  for  the  effective  and  efficient  accomplishment  of 
the  organizations'  objectives,  whether  of  the  public  or 
private  sector. 

The  research  consisted  primarily  of  a  detailed  search  and 
evaluation  of  the  literature  in  the  area  of  internal  control 
and  management  control. 
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II.   EVOLUTION  OF  THE  TERM  INTERNAL  CONTROL 

A.  INTRODUCTION 

The  following  chapters  will  compare  the  development  of 
the  concept  of  internal  control  in  the  private  sector  with 
the  evolution  in  the  public  arena.   Topics  to  be  considered 
are:   definitional  concerns,  the  establishment  of  a  system  of 
internal  control  and  its  purpose,  the  process  of  internal 
control  reviews,  and  finally,  a  conceptualization  of  the 
concept  from  a  management  perspective. 

B.  EVOLUTION  OF  DEFINITION  IN  THE  PRIVATE  SECTOR 

A  major  concern  with  internal  control  in  the  private 
sector  arises  from  the  function  of  the  independent  audit  — 
the  independent  investigation  of  a  business  firm's  financial 
statements  by  Certified  Public  Accountants  (CPAs) .   In  this 
context,  management  of  the  business  firm  is  responsible  for 
adopting  sound  accounting  policies,  accounting  procedures, 
and  the  presentation  of  financial  data.   The  independent  auditor 
or  CPA,  based  on  his  or  her  review  of  evidence  relating  to 
the  reliability  of  financial  data  and  the  safeguarding  of 
assets  and  records,  provides  an  independent  opinion  on  the 
fairness  of  management's  presentation  of  financial  data  as 
a  basis  for  third  party  reliance. 

Since  the  volume  of  transactions  within  most  commercial 
firms  precludes  review  of  each  and  every  economic  event,  one 
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of  the  ten  Generally  Accepted  Auditing  Standards  states: 

There  is  to  be  a  proper  study  and  evaluation  of  the  exist- 
ing internal  control  as  a  basis  for  reliance  thereon  and 
for  the  determination  of  the  resultant  extent  of  the 
tests  to  which  auditing  procedures  are  to  be  restricted. 
[Ref.  3] 

Utilizing  this  professional  standard  established  by  the 

American  Institute  of  Certified  Public  Accountants  (AICPA)  in 

the  late  1940 's,  the  auditor  can  effectively  limit  the  amount 

of  audit  evidence  accumulated,  if  he  believes  that  the  client 

has  a  system  of  internal  control  which  provides  reliable 

financial  information  and  protects  assets  and  records.   If  he 

determines  any  of  the  internal  controls  are  inadequate,  he 

cannot  rely  on  them  and  must  seek  a  greater  quantity  of 

evidence. 

Note  that  this  audit  standard,  as  well  as  the  other  nine, 
is  broad  and  does  not  provide  a  detailed  methodology  for 
accomplishment.   It  is  meant  to  serve  as  a  guide  to  the 
selection  of  the  proper  procedures  based  on  the  individual 
auditor's  judgment  of  the  pertinent  methods  appropriate  to  a 
situation.   In  fact,  judgment  is  heavily  emphasized  in  the 
application  of  audit  standards. 

The  definition  of  the  term  internal  control  has  varied  in 
the  private  sector  since  the  1930s. 

In  19  49  the  Committee  on  Auditing  Procedures  (CAP)  of  the 

AICPA  formally  defined  the  term  as: 

Internal  control  comprises  the  plan  of  organization  and 
all  of  the  coordinate  methods  and  measures  adopted  within 
a  business  to  safeguard  its  assets,  check  the  accuracy 
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and  reliability  of  its  accounting  data,  promote  opera- 
tional efficiency,  and  encourage  adherence  to  prescribed 
managerial  policies.  [Ref.  4] 

This  definition  is  broader  than  the  meaning  presently  at- 
tributed to  the  term  by  practicing  auditors.   By  the  inclusion 
of  the  phrase  "  ...  promote  operational  efficiency  and 
encourage  adherence  to  prescribed  managerial  policies,"  this 
statement  recognizes  that  a  system  of  internal  control  extends 
beyond  those  matters  which  are  directly  of  an  accounting  or 
financial  nature. 

Such  a  system  might  include  budgeting  control,  standard 
costs,  periodic  operating  reports,  statistical  analysis  ... 
a  training  program  ...  to  aid  personnel  in  meeting  their 
responsibilities,  and  an  internal  audit  staff  to  provide 
additional  assurance  to  management  as  to  the  adequacy 
of  its  outlined  procedures  and  the  extent  to  which  they 
are  being  carried  out.   It  properly  comprehends  activities 
in  other  fields  (such  as)  time  and  motion  studies  . . .  and 
use  of  quality  controls.  [Ref.  5] 

Such  a  definition  was  perceived  as  too  expansive  for 
Certified  Public  Accountants*  purposes,  so  the  accounting 
profession  subdivided  the  term  into  accounting  controls  and 
administrative  controls  in  an  effort  to  narrow  the  auditor's 
review  as  it  pertains  to  his  examination  leading  to  the  ex- 
pression of  an  opinion  on  financial  statements.   In  response 
to  critics  of  the  above  definition  of  internal  control,  CAP 
modified  the  definition  in  1958  as  follows: 

Internal  control,  in  the  broad  sense  includes:   control 
which  may  be  characterized  as  either  accounting  or 
administrative  as  follows: 

Accounting  controls  comprise  the  plan  of  organization  and 
all  the  methods  and  procedures  that  are  concerned  mainly 
with,  and  relate  directly  to  the  safeguarding  of  assets 
and  the  reliability  of  the  financial  records.   They 
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generally  include  such  controls  as  the  systems  of  authoriza- 
tion and  approval,  separation  of  duties  concerned  with 
record  keeping  and  accounting  reports  from  those  concerned 
with  operations  or  asset  custody,  physical  controls  over 
assets  and  internal  auditing. 

Administrative  controls  comprise  the  plan  of  organization 
and  all  the  methods  and  procedures  that  are  concerned 
mainly  with  operational  efficiency  and  adherence  to 
managerial  policies  and  usually  relate  only  indirectly 
to  the  financial  records.   They  generally  include  such 
controls  as  statistical  analysis,  time  and  motion  studies, 
performance  reports,  employee  training  programs,  and 
quality  controls.  [Ref.  6] 

In  1963  CAP  further  narrowed  the  independent  auditor's 

responsibility  for  evaluating  internal  control: 

The  independent  auditor  is  primarily  concerned  with  the 
accounting  controls.   Accounting  controls  ...  generally 
bear  directly  and  importantly  on  the  reliability  of 
financial  records  and  require  evaluation  by  the  auditor. 
Administrative  controls  . . .  ordinarily  relate  only 
indirectly  to  the  financial  records  and  thus  would  not 
require  evaluation.  [Ref.  7] 

Not  everyone  agreed  with  this  limitation  of  the  concept 

which  served  to  narrow  the  scope  of  the  independent  CPA's 

review.   In  1957  Paul  Grady,  chairman  of  CAP  when  the  original 

broad  definition  was  issued,  commented  on  the  controversy: 

The  suggested  narrowing  of  viewpoint,  in  my  opinion,  would 
constitute  serious  retrogression  and  impair  the  founda- 
tion of  independent  auditing.   It  may  sound  paradoxical, 
but  there  are  many  endeavors  wherein  a  broader  concept  of 
responsibility  results  in  a  lesser  risk.   In  the  present 
international  situation  the  recently  announced  Middle 
East  Policy  obviously  broadens  our  responsibility.   We 
have  undertaken  it,  however,  in  order  to  lessen  the  risk 
of  war.   Similarly,  the  broader  view  of  investigation  and 
evaluation  of  internal  control  lessens  the  business  risk 
inherent  in  the  work  of  the  independent  auditor.  [Ref.  8] 

Despite  this  warning,  the  auditing  profession  proceeded 

to  practice  the  narrower  concept.   As  time  passed,  the 
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independent  auditor's  evaluation  of  management's  policies 
was  found  lacking  in  a  number  of  legal  cases.   These  legal 
proceedings  applied  the  internal  control  concept  as  estab- 
lished in  the  inclusive  1949  framework  when  evaluating  the 
auditor's  actions. 

Because  of  difficulties  in  interpretation,  CAP  felt  that 
clarification  of  the  two  types  of  internal  control  was 
desirable.   In  1972,  the  revised  statements  were  promulgated 
as  follows: 

Administrative  control  includes,  but  is  not  limited  to 
the  plan  of  organization  and  the  procedures  and  records 
that  are  concerned  with  the  decision  processes  leading 
to  management's  authorization  of  transactions.   Such 
authorization  is  a  management  function  directly  asso- 
ciated with  the  responsibility  for  achieving  the 
objectives  of  the  organization  and  is  the  starting  point 
for  establishing  accounting  control  of  transactions. 

Accounting  control  comprises  the  plan  of  organization  and 
the  procedures  and  records  that  are  concerned  with  the 
safeguarding  of  assets  and  the  reliability  of  financial 
records  and  consequently  are  designed  to  provide  reason- 
able assurance  that: 

-  Transactions  are  executed  in  accordance  with  manage- 
ment's general  or  specific  authorization. 

-  Transactions  are  recorded  as  necessary  (1)  to  permit 
preparation  of  financial  statements  in  conformity 
with  generally  accepted  accounting  principles  or  any 
other  criteria  applicable  to  such  statements  and  (2) 
to  maintain  accountability  for  assets. 

-  Access  to  assets  is  permitted  only  in  accordance  with 
management's  authorization. 

-  The  recorded  accountability  for  assets  is  compared 
with  the  existing  assets  at  reasonable  intervals 
and  appropriate  action  is  taken  with  respect  to  any 
differences.  [Ref.  9] 
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The  committee  emphasized  that  accounting,  not  administra- 
tive, control  was  to  be  the  focus  of  audits. 

Ignoring  the  court's  interpretation  of  internal  control 
in  legal  actions  and  the  SEC  disciplinary  proceedings  against 
auditors,  in  1975,   Statement  on  Auditing  Standards  (SAS) 
No.  9  explicitly  narrowed  the  traditional  reference  to  an 
evaluation  of  internal  control  to  read  "...  evaluation  of 
internal  accounting  control."   This  clearly  separates  internal 
control  into  that  of  a  "financial"  nature  versus  "management" 
control. 

During  this  period  of  the  mid-1970' s  the  Securities  and 
Exchange  Commission  (SEC)  censured  several  of  the  large  audit- 
ing firms  for  lack  of  independence  and  certification  of  false 
financial  statements  and  inadequate  audit  procedures.   As  a 
result,  the  public  began  to  question  the  reliability  of 
corporate  financial  statements  and  the  role  of  the  independent 
auditor.   The  AICPA  requested  that  the  Commission  on  Auditor's 
Responsibilities  develop  conclusions  and  recommendations 
regarding  the  appropriate  responsibilities  of  independent 
auditors.   This  commission  included  a  number  of  prominent 
non-accountants.   Findings  included  the  following: 

The  Commission  observed  that  financial  reporting  has 
become  a  continuous  process  rather  than  an  annual  event. 
Much  of  the  information  is  therefore,  unaudited  ... 
More  importantly  users  are  implicitly  relying  on  an 
adequate  system  of  internal  controls.   Internal  controls 
assure  that  unaudited  information  released  by  corporations 
is  materially  accurate.   The  Commission  observed  the 
societal  concern  over  illegal  and  questionable  corporate 
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payments  and  the  attention  focused  on  corporate  account- 
ability and  the  importance  of  controls  over  the  accounting 
system.   The  Commission  noted  that  the  adequacy  of  internal 
controls  is  an  important  investment  criterion  to  creditors 
and  shareholders.   The  Commission  ...  recommended  that 
the  auditors  expand  their  study  to  review  and  test  the 
entire  accounting  control  system  . . .  greater  involvement 
of  the  auditor  in  the  corporate  reporting  system  and  a 
change  in  the  auditor's  focus  ...  to  the  examination  of 
a  function.  [Ref.  10] 

Before  the  Commission  on  Auditor's  Responsibilities  issued 

its  final  report,  the  Auditing  Standards  Board  of  the  AICPA 

issued  SAS  No.  20  in  December  1977.   This  statement  required 

auditors  to  inform  management  of  material  weaknesses  in 

internal  accounting  control  but  it  also  continued  to  limit 

the  scope  of  the  auditor's  review: 

"...  there  is  no  requirement  under  generally  accepted 

auditing  standards  to  evaluate  each  control  ..."  [Ref.  11] 

The  independent  auditor  is  only  expected  to  test  the  controls 

upon  which  he  intends  to  rely. 

During  this  same  time  period,  the  media  reported  on  several 
cases  of  falsified  corporate  records  and  maintenance  of  off- 
the-books  slush  funds. 

As  a  result,  Congress  passed,  and  President  Carter  signed, 
the  Foreign  Corrupt  Practices  Act  (FCPA)  of  1977.  Bribes  or 
payments  to  foreign  officials  and  others  to  obtain  or  retain 
business  were  indeed  prohibited  by  this  legislation  but  the 
important  provisions  required  all  publicly  held  companies  to 
establish  and  maintain  adequate  systems  of  internal  account- 
ing control  defined  as: 
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...  a  system  of  internal  accounting  controls  sufficient 
to  provide  reasonable  assurance  that: 

-  transactions  are  executed  in  accordance  with  management's 
general  or  specific  authorization 

-  transactions  are  recorded  as  necessary  to  permit  prepara- 
tion of  financial  statements  in  conformity  with  generally 
accepted  accounting  principles  or  any  other  criteria 
applicable  to  such  statements,  and  to  maintain  account- 
ability for  assets 

-  access  to  assets  is  permitted  only  in  accordance  with 
management's  general  or  specific  authorization 

-  the  recorded  accountability  for  assets  is  compared  with 
the  existing  assets  at  reasonable  intervals  and  approp- 
riate action  is  taken  with  respect  to  any  differences. 

Note  that  these  points  are  directly  derived  from  the  profes- 
sional auditing  literature,  namely  CAP ' s  1972  clarification 
of  the  types  of  internal  control. 

In  its  interpretation  of  the  internal  accounting  control 
provisions  of  the  FCPA,  the  American  Bar  Association  warned: 

...  Foreign  bribery  is  a  relatively  rare  event,  but 
maintenance  of  financial  records  and  internal  accounting 
controls  are  major  everyday  activities  of  every  registered 
or  reporting  company  . . .  (this  may  be)  the  most  extensive 
application  of  federal  law  in  internal  corporate  affairs 
since  the  passage  of  the  1933  and  1934  (security)  Acts 
. . .  (others)  foresee  at  least  the  possibility  that  the 
new  statute  will  create  extensive  new  liabilities  for 
corporate  managements,  auditors,  and  corporate  counsel. 
[Ref.  12] 

The  AICPA  appointed  the  Special  Advisory  Committee  on 

Internal  Accounting  Control  to  provide  guidance  to  management 

in  reviewing  and  implementing  internal  controls.   The  forward 

to  the  Committee's  report  states  that  the  broad  guidance  in 

the  professional  literature  had  been  developed  for  the  limited 

purpose  of  the  auditing  profession  and  noted  the  need  to 
provide  guidance  helpful  to  management. 
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The  Committee  declared  that  management  should  be  concerned 

with  all  of  its  internal  accounting  controls  and  cited  the 

following  broad  definition  from  SAS  No.  1  for  management's 

purposes: 

The  foregoing  definitions  (of  .internal  accounting  control 
and  administrative  control)  are  not  necessarily  mutually 
exclusive  because  some  of  the  procedures'  and  records 
comprehended  in  accounting  control  may  also  be  involved  in 
administrative  control  ...  For  practical  purposes,  this  is 
tantamount  to  including  within  the  definition  of  accounting 
controls  any  administrative  controls  that  have  an  important 
bearing  on  the  reliability  of  the  financial  statements. 

Thus  the  statement  underlines  the  fact  that  as  far  as 
managers  are  concerned  administrative  and  accounting  controls 
are  interrelated  and  both  types  reinforce  management  controls  ■ 
measures  employed  to  obtain  the  organization's  objectives. 

This  discussion  was  not  meant  as  a  historical  review  of 
actions  in  the  private  sector  but  rather  was  an  attempt  to 
illustrate  the  development  of  the  concept  of  internal  control 
in  the  private  sector  from  a  broad  expansive  term,  to  a 
narrow  limited  focus  for  the  benefit  of  the  auditing  profes- 
sion and  a  final  recognition  by  that  same  profession  that 
management's  concerns  are  broader  and  that  therefore  the 
controls  contemplated  in  the  1949  definition  are  more 
appropriate  for  them. 

C.   EVOLUTION  OF  DEFINITION  IN  THE  PUBLIC  SECTOR 

As  part  of  Reform  88,  the  Reagan  Administration  is  com- 
mitted to  streamlining  the  management  and  administration  of 
the  federal  government.   This  initiative  includes  reducing 
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fraud,  improving  management  controls  and  eliminating  errors 
in  the  administration  of  government  programs. 

In  October  1981,  the  Office  of  Management  &  Budget  (OMB) 
issued  Circular  A-123  on  internal  control  systems  as  an  early 
effort  to  improve  these  systems.   The  circular  defined  require- 
ments and  responsibilities  in  order  to  transform  the  1950 
Act's  expectations  into  reality.   It  prescribed  policies  and 
standards  for  executive  agencies  in  establishing  and  maintain- 
ing internal  controls  in  their  program  and  administrative 
functions. 

At  that  time  OMB  defined  Internal  Control  (as) : 

the  plan  of  organization  and  all  of  the  methods  and  measures 
adopted  within  an  agency  to  safeguard  its  resources,  assure 
the  accuracy  and  reliability  of  its  information,  assure 
adherence  to  applicable  laws,  regulations  and  policies, 
and  promote  operational  economy  and  efficiency.  [Ref.  13] 

This  definition  is  very  similar  to  the  1949  AICPA  broad 

concept  of  internal  control  in  that  it  includes: 

OMB  Circular  1949  Definition 

the  safeguarding  of  resources     -   safeguarding  assets 

assuring  the  accuracy  and  re-    -   check  the  accuracy  and 
liability  of  its  information        reliability  of  its 

accounting  data 

assuring  adherence  to  applica-   -   encourage  adherence  to 
ble  laws,  regulations  and  prescribed  managerial 

policies  policies 

promote  operational  economy      -   promote  operational 
and  efficiency  efficiency 

In  fact,  based  on  the  parallel  construction  above,  this 

definition  is  even  more  general  than  the  original  private 
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sector  statement.   In  this  format,  it  has  served  as  the  basis 

for  much  of  the  guidance  promulgated  to  executive  federal 

agencies. 

However,  in  August  1983,  OMB  issued  a  revised  Circular 

A-123  which  redefined  Internal  Control  (as) : 

the  plan  of  organization  and  methods  and  procedures  adopted 
by  management  to  provide  reasonable  assurance  that  obliga- 
tions and  costs  are  in  compliance  with  applicable  law;  funds, 
property  and  other  assets  are  safeguarded  against  waste, 
loss,  unauthorized  use,  or  misappropriation;  and  revenues 
and  expenditures  applicable  to  agency  operations  are  properly 
recorded  and  accounted  for  to  permit  the  preparation  of 
accounts  and  reliable  financial  and  statistical  reports 
and  to  maintain  accountability  over  the  assets.  [Ref.  14] 

Note  that  this  focus  is  narrower  and  related  closely  to  the 
auditing  profession's  1958  delineation  of  accounting  controls. 
All  references  to  the  administrative  controls,  those  of  ad- 
herence to  applicable  laws,  regulations,  and  policies  and  the 
promotion  of  operational  economy  and  efficiency  have  been 
dropped. 

The  Department  of  Defense  (DOD)  promulgated  OMB's  original 
Circular  A-123  by  issuing  DOD  Directive  7040.6,  Internal  Control 
Systems,  24  March  1982.   This  document  established  DOD ' s  pro- 
gram of  internal  control,  assigned  responsibilities  and 
provided  procedures  to  ensure  that  DOD  resources  are  efficiently 
and  effectively  managed.   It  also  appropriated  OMB's  original 
broad  definition  of  internal  control. 

A  policy  statement  of  the  directive  served  to  support  the 
broad  formulation  of  the  term: 
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Internal  controls  are  management's  responsibility  and 
should  be  in  effect  across  the  board  in  every  organiza- 
tion within  each  DOD  component.   Adequate  internal 
control  is  required  to  assure  that  all  resources  are 
efficiently  and  effectively  managed  and  is  the  basic 
foundation  for  integrity  in  any  management  system. 
Although  internal  controls  in  themselves  cannot  prevent 
every  incident  of  waste,  mismanagement  and  fraud,  DOD 
policy  is  to  ensure  that  resources  are  properly  managed 
and  controlled  within  the  Department  of  Defense.  [Ref.  15] 

A  revision  of  DOD ' s  directive  is  currently  in  draft  form 
and  a  review  of  it  indicates  that  DOD  has  adopted  OMB ' s 
revised  definition  of  internal  control  but  has  chosen  to 
title  it  Management  Control.   It  is  interesting  to  note  that 
a  number  of  other  definitions  within  the  revision  emphasize 
the  "management"  control  aspect  yet  use  the  same  meanings 
OMB  has  ascribed  to  internal  control  with  an  accounting  focus, 
i.e.,  management  control  review,  management  control  system. 

The  revised  paper  still  retains  the  original  DOD  policy 
statement  concerning  management's  responsibility  in  relation 
to  internal  controls. 

In  September  19  82,  Congress  passed  the  Federal  Managers' 
Financial  Integrity  Act  (FMFIA) ,  an  amendment  to  the  pre- 
viously mentioned  Accounting  and  Auditing  Act  of  19  50  which 
placed  the  cognizance  for  the  effectiveness  of  financial 
management  systems  in  preventing  fraud,  waste,  and  abuse  upon 
federal  managers. 

One  provision  of  the  FMFIA  requires  that: 

Internal  accounting  and  administrative  controls  . . .  shall 
provide  reasonable  assurances  that  obligations  and  costs 
are  in  compliance  with  applicable  law;  funds,  property 
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and  other  assets  are  safeguarded  against  waste,  loss, 
unauthorized  use,  or  misappropriation;  and  revenues  and 
expenditures  applicable  to  agency  operations  are  properly 
recorded  and  accounted  for.  [Ref.  16] 

The  revised  definitions  of  internal  control  issued  by  OMB 
and  DOD  are  certainly  better  aligned  with  the  objectives  of 
this  provision  which  does  not  mention  program  results  or 
operational  economy  and  efficiency. 

Secretary  of  the  Navy  Instruction  (SECNAVINST  5200.35), 
Internal  Control  in  the  Department  of  the  Navy,  was  issued  on 
29  July  1983.   It  implemented  the  original  versions  of  OMB ' s 
Circular  and  the  DOD  Directive,  as  well  as  the  FMFIA,  within 
the  DON  and  established  the  Navy's  own  program  to  develop, 
maintain,  review  and  improve  internal  control  systems  to  en- 
sure resources  are  efficiently  and  effectively  managed. 

Since  DON's  instruction  is  based  on  the  first  publications 

of  OMB  and  DOD,  one  would  expect  that  the  Navy's  definition 

would  support  the  broader  connotation  of  internal  control  and 

it  does: 

. . .  the  plan  of  organization  and  all  of  the  methods  and 
measures  adopted  within  the  DON  to: 

Safeguard  resources  and  assure  the  accuracy  and 
reliability  of  information  taccounting  controls) 

Assure  adherence  to  applicable  laws,  regulations, 
and  policies  and  promote  operational  economy  and 
efficiency  (administrative  controls. 

Internal  controls  are  management  controls  and  apply  to 
the  entire  range  of  DON  programs  and  functions. 
[Ref.  17] 
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Other  statements  within  this  instruction  also  stress  the 

management  aspects  of  internal  controls: 

. . .  implementing  and  carrying  out  an  internal  control 
program  is  a  management  responsibility. 

Vulnerability  assessment.   A  management  evaluation  . . . 
Management  control  review  . . .  reviews  performed  by 
managers  responsible  for  the  program/function  under 
review  ...  [Ref.  18] 

It  is  most  likely  that  DON  will  revise  its  recent  instruc- 
tion to  better  coordinate  with  the  latest  guidance  from  OMB 
and  DOD. 

D.   CONCLUSION 

By  now  it  should  be  clear  that  there  are  a  number  of 
similarities  in  the  evolution  of  the  definition  of  internal 
control  within  the  private  and  public  sectors.   Both  have 
long  recognized  the  importance  of  adequate  systems  of  control, 
Both  sectors  began  with  a  broad  definition  of  internal  con- 
trol and  each  has  moved  to  a  more  limited  view.   Much  impetus 
for  current  interest  in  this  subject  has  developed  because  of 
recent  legislation  to  correct  failings  in  operations:   the 
FCPA  in  the  private  sector  and  the  FMFIA  in  the  public  sector 
There  is  little  guidance  in  either  sector  on  specifics;  broad 
direction  is  all  that  is  provided. 

In  the  private  sector,  the  major  portion  of  the  profes- 
sional literature  has  been  directed  toward  the  purposes  of 
the  independent  auditor  who  uses  his  own  evaluation  of 
management's  system  as  a  basis  to  limit  the  scope  of  his 
audit  tests  in  financially  related  areas. 
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The  public  sector  has  taken  the  literature  originated 
for  these  narrow  purposes  and  tried  to  superimpose  it  on 
systems  of  internal  control  where  a  non-independent  management 
has  responsibility  for  its  stewardship  of  all  resources. 

It  is  unclear  that  the  approach  advocated  by  the  auditing 
profession  and  the  AICPA  is  necessarily  correct  for  either 
public  or  private  sector  management.   The  inclusive  interpre- 
tation as  defined  in  1948  can  provide  administrative,  as  well 
as  accounting  data  —  all  information  management  is  responsible 
for.   Thus,  as  Grady  stated  in  1957,  "a  broader  concept  of 
responsibility  results  in  a  lesser  risk." 
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III.   SYSTEMS  OF  INTERNAL  CONTROL 

A.  INTRODUCTION 

Management  is  responsible  for  establishing  and  maintaining 
its  system  of  internal  controls  in  order  to  provide  reliable 
data,  safeguard  assets  and  records,  and  promote  operational 
efficiency.   The  pioneer  literature  in  this  area  of  management 
planning  and  control  systems  was  published  in  the  1960's  by 
R.  N.  Anthony.   A  discussion  of  his  framework  will  be  presented 
in  this  section,  as  well  as  descriptions  of  internal  control 
systems  within  the  private  and  public  domains. 

B.  ANTHONY'S  MANAGEMENT  CONTROL  FRAMEWORK 
1.   Planning  and  Controlling  Processes 

In  his  book,  Planning  and  Control  Systems;  A  Framework 
for  Analysis,  Anthony  presented  his  concept  of  systems  designed 
to  facilitate  planning  and  control  processes  within  organiza- 
tions, whether  profit  or  nonprofit. 

Within  the  framework  of  deciding  what  to  do  and  how  to 
do  it  (planning)  and  assuring  results  are  attained  (controlling) , 
three  main  categories  of  internal  activities  carried  on  in  an 
organization  at  different  times,  by  different  people,  or  for 
different  situations  can  be  delineated,  Figure  1. 

Strategic  planning  is  defined  as  the  process  of 
deciding  on  objectives  of  the  organization,  on  changes  in 
these  objectives,  on  the  resources   used  to  attain  these 


27 


EXAMPLES  OF  ACTIVITIES  IN  A  BUSINESS  ORGANIZATION  INCLUDED  IN 

MAJOR  FRAMEWORK  HEADINGS 


*  ** 

Strategic  Planning   Management  Control 


**  * 

Operational  Control 


Choosing  company 
objectives 

Planning  the 
organization 

Setting  personnel 
policies 

Setting  financial 
policies 

Setting  marketing 
policies 

Setting  research 
policies 

Choosing  new 
product  lines 

Acquiring  a  new 
division 

Deciding  on  non- 
routine  capital 
expenditures 


Formulating  budgets 


Planning  staff  levels  Controlling  hiring 

Formulating  personnel  Implementing  policies 
practices 


Working  capital 
planning 

Formulating  adver- 
tising programs 


Controlling 
extension 

Controlling  placement 
of  advertisements 


Scheduling  production 


Deciding  on 
research  projects 

Choosing  product 
improvements 

Deciding  on  plant 
rearrangement 

Deciding  on  routine 
capital  expenditures 

Formulating  decision  Controlling  Inventory- 
rules  for  operational 
control 

Measuring,  appraising  Measuring,  apprais- 
and  improving  man-  ing,  and  improving 
agement  performance   workers'  efficiency 


*    Planning  activities 

**    Planning  &  Controlling  activities 

***   Controlling  activities 

Figure  1 


[Ref.  20] 


28 


objectives,  and  on  the  policies  that  are  to  govern  the 
acquisition,  use  and  disposition  of  these  resources. 

"Strategy"  is  used  in  its  usual  sense  of  combining  and 
employing  resources.   It  connotes  big,  important  plans  with 
major  consequences.   "Objectives"  are  what  the  total  organiza- 
tion wishes  to  accomplish  and  "policies"  are  guidelines  to  be 
used  in  the  choice  of  the  most  appropriate  course  of  action 
for  accomplishing  the  objectives. 

Another  type  of  planning  is  concerned  with  the  con- 
tinuing administration  of  the  organization  and  is  closely 
associated  with  control  activities.   This  is  management 
control,  the  process  by  which  managers  assure  that  resources 
are  obtained  and  used  effectively  and  efficiently  in  the  ac- 
complishment of  the  organization's  goals.   Three  important 
ideas  are  conveyed  by  this  statement:   the  process  involves 
managers,  people  who  get  things  done  by  working  with  others; 
the  process  occurs  within  a  context  of  objectives  and  policies 
that  have  been  arrived  at  in  the  strategic  planning  process; 
the  criteria  for  judging  the  actions  in  this  process  are 
effectiveness  and  efficiency.   This  is  the  root  of  the  term  as 
used  in  the  DOD  and  DON  documents  mentioned  in  the  previous 
chapter. 

Since  the  line  dividing  strategic  planning  from  manage- 
ment control  is  blurred  as  one  process  interacts  and  shades 
into  the  other,  figure  2  attempts  to  delineate  significant 
distinctions  between  the  two  processes. 
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SOME  DISTINCTIONS  BETWEEN  STRATEGIC  PLANNING  AND  MANAGEMENT 

CONTROL 


Characteristic 


Focus  of  plans 


Complexities 


Strategic  Planning 

On  one  aspect  at  a  time 

Many  variables 


Degree  of  structure   Unstructured  and 

irregular;  each 


Nature  of 
information 


problem  different 

Tailor  made  for  the 
problem;  more 
external  and  predic- 
tive; less  accurate 


Communication  of 
information 


Relatively  simple 
Purpose  of  estimates  Show  expected  results 


Persons  primarily 
involved 

Number  of  persons 
involved 

Mental  activity 


Source  discipline 


Staff  and  top 
management 

Small 


Creative;  analytical 


Economics 


Planning  and  control  Planning  dominant, 

but  some  control 


Time  horizon 
End  result 


Apprisal  of  the 
job  done 


Tends  to  be  long 

Policies  and 
precedents 


Extremely  difficult 
Figure  2 
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Management  Control 

On  whole  organiza- 
tion 

Less  complex 

Rhythmic;  pres- 
cribed procedures 


Integrated;  more 
internal  and 
historical;  more 
accurate 

Relatively  difficult 


Lead  to  desired 
results 

Line  and  top 
management 

Large 


Administrative ; 
persuasive 

Social  psychology 

Emphasis  on  both 
planning  and 
control 

Tends  to  be  short 

Action  within 
policies  and 
precedents 

Much  less 
difficult 

[Ref.  21] 


The  third  element  is  based  on  the  distinction  between 
the  activities  referred  to  as  management  and  activities  that 
relate  to  the  performance  of  specific  tasks. 

Operational  control  is  the  process  of  assuring  that 
specific  tasks  are  carried  out  effectively  and  efficiently. 

Distinguishing  characteristics  between  operational 
control  and  management  control  are  that  operational  control 
focuses  on  specific  tasks  or  transactions,  whereas  management 
control  focuses  on  the  flowing  stream  of  continuing  operations; 
operational  control  is  essentially  objective  in  the  sense  that 
it  has  to  do  primarily  with  activities  for  which  the  correct 
decisions  can  be  objectively  determined.   At  least  concept- 
ually, and  often  practically,  a  valid  decision  rule  can  be 
stated  mathematically  and  programmed  into  a  computer.   Manage- 
ment control  is  essentially  subjective  in  that  decisions  in 
this  process  inherently  involve  management  judgment  and  there 
is  no  objective  or  "scientific"  way  of  determining  the  best 
course  of  action  in  a  situation. 

As  with  the  distinction  between  strategic  planning  and 
management  control,  the  distinction  between  management  control 
and  operational  control  is  ill-defined,  the  processes  overlap 
and  are  interrelated.   Figure  3  is  presented  to  clarify  the 
categories . 

Despite  the  presentation  of  these  discrete  elements, 
the  planning  and  control  process  is  a  continuum.  Management 
control  is  a  process  carried  on  within  guidelines  established 
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SOME  DISTINCTIONS  BETWEEN  MANAGEMENT  CONTROL  AND  OPERATIONAL 

CONTROL 


Characteristic 


Focus  of  activity 


Judgment 


Management  Control 
Whole  operation 


Relatively  much; 
subjective  decisions 


Nature  of  structure   Psychological 

Nature  of  information  Integrated;  finan- 
cial data  through- 
out; approximations 
acceptable;  future 
and  historical 


Persons  primarily 
involved 

Mental  activity 

Source  discipline 

Time  horizon 
Type  of  costs 


Management 

Administrative ; 
persuasive 

Social  physchology 

Weeks,  months,  years 
Managed 


Operational  Control 

Single  task  or 
transaction 

Relatively  little; 
reliance  on  rules 

Rational 

Tailormade  to  the 
operation;  often 
non-financial ; 
precise;  often  in 
real  time 

Supervisors  (or 
none) 

Follow  directions 
(or  none) 

Economics;  physical 
sciences 

Day-to-day 

Engineered 


Figure  3 


[Ref.  22] 
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by  strategic  planning.   Objectives,  facilities,  organization, 
and  financial  factors  are  accepted  as  given  operational 
constraints.   Operational  control  takes  place  within  a  context 
of  decisions  made  and  rules  formulated  in  the  management  con- 
trol process  and  to  some  extent  in  the  strategic  planning 
process.   Overall  performance  of  operational  control  activities 
are  reviewed  as  part  of  the  management  control  process. 

Anthony  discusses  two  other  processes  distinct  from 
management  control.   The  first  is  information  handling,  the 
process  of  collecting,  manipulating  and  transmitting  informa- 
tion, whatever  its  use.   The  author  presents  two  reasons  for 
regarding  this  process  as  separate  from  the  other  elements. 
Although  useful  for  planning  and  control,  information  is 
primarily  handled  for  a  functional  purpose  and  the  system 
is  designed  to  meet  the  requirement  of  these  purposes.   Also, 
there  is  a  recognized  body  of  knowledge  and  skill,  an  expert- 
ise, which  identifies  information  handling  as  a  separate  process 

The  first  three  processes  are  concerned  with  activi- 
ties which  occur  inside  an  organization.   The  final  process  has 
an  external  orientation. 

Financial  accounting  is  defined  as  the  process  of 
reporting  objective  financial  information  about  the  organiza- 
tion to  the  outside  world.   The  distinction  is  made  that 
society  has  developed  certain  financial  accounting  principles 
to  which  all  businesses  are  expected  to  adhere,  whereas  no 
such  externally  imposed  principles  govern  management  control 
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information  —  the  accounting  information  useful  to  internal 
parties  for  solving  problems  and  achieving  goals. 

Figure  4  interrelates  the  five  topics  just  discussed. 

The  management  control  process,  the  starting  point  in 
constructing  a  planning  and  control  system,  will  be  discussed 
in  more  detail  below.   It  is  this  system  which  deals  with  the 
continuing  operation  of  the  whole  enterprise. 
2 .   The  Management  Control  Process 

In  Management  Control  in  Nonprofit  Organizations, 
Anthony  and  Herzlinger  recognize  the  informal  and  formal 
process  concerned  with  an  organization's  current  operations. 
The  informal  management  control  process  consists  of  memoranda, 
meetings,  and  conversations.   The  formal  management  control 
system  includes  information  on  planned  (or  estimated)  and 
actual  data  on  outputs,  goods  and  services,  and  inputs, 
resources.   Prior  to  actual  operations,  decisions  and  esti- 
mates are  made  as  to  what  outputs  and  inputs  are  to  be;  during 
actual  operations,  records  are  maintained  as  to  what  output 
and  input  actually  are;  and  subsequent  to  operations,  reports 
are  prepared  that  compare  actual  outputs  and  inputs  to  planned 
outputs  and  inputs  and  action  is  taken  on  the  basis  of  these 
reports. 

The  formal  management  control  process,  figure  5, 
consists  of  the  following  steps  which  occur  in  a  regular, 
recurring  cycle: 
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PLANNING  AND  CONTROL  PROCESSES  IN  ORGANIZATION? 


Intsrnallv  Oriented  Processes 


I 


Stratecic  Planninc 


i 


Management 
Control 


^Operational 
Control 


o 
r 

m 

a 

t 


Externallv  Oriented  Process 


Financial  Accounting 


Figure  4 
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External 

Information 


Strategie 


External 
Information 


strateq^ 


External 
Information 


External 
Information 


Figure  5 


[Ref.    23] 
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Programming 

Budgeting 

Operating  and  Measurement 

Reporting  and  Analysis. 

a.   Programming 

In  this  phase,  decisions  are  made  with  respect  to 
the  major  programs  the  organization  plans  to  undertake  during 
the  coming  time  period.   These  decisions  are  usually  made  in 
the  context  of  the  objectives  and  strategies  that  have  already 
been  determined.   It  is  within  this  step  that  the  strategic 
and  management  control  processes  merge. 

Organizations  may  state  their  programs  in  the  form 
of  a  long-range  plan  which  shows  planned  outputs  and  inputs 
for  a  number  of  years  ahead,  three,  five  or  as  many  as  twenty 
years. 

In  an  industrial  company,  the  "programs"  are  usually 
business  lines  or  products.   In  a  nonprofit  organization,  the 
principal  programs  are  the  mission  areas,  such  as  strategic 
forces,  intelligence  and  communications,  research  and  develop- 
ment, and  training  programs  within  the  Navy.   The  plans  state 
the  amount  and  character  of  resources,  inputs,  to  be  devoted 
to  each  program  and  the  ways  in  which  these  resources  are  to 
be  used.   The  accounting  information  used  at  this  point  is 
program  data  and  provides  full  cost  information  for  a  specific 
program. 

Where  possible,  program  decisions  are  based  on  a 
comparative  economic  analysis  as  to  whether  the  estimated 
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benefits  from  the  program  are  equal  or  greater  than  the  esti- 
mated costs.   For  many  programs,  particularly  in  nonprofit 
organizations,  reliable  estimates  of  benefits  cannot  be  made. 
In  these  cases,  decisions  are  based  on  judgments  and  are 
influenced  by  the  persuasive  abilities  of  program  advocates, 
and  by  political  and  other  considerations, 
b.   Budgeting 

A  budget  is  a  plan  expressed  in  quantified  terms 
covering  a  specified  period  of  time,  usually  one  year.   In 
this  process,  the  program  is  translated  into  terms  that  cor- 
respond to  the  sphere  of  responsibility  of  those  who  must 
execute  it.   Thus,  the  plans  of  the  program  phase  are  con- 
verted into  organizational  terms  in  the  budget  phase.   The 
process  of  arriving  at  this  budget  is  essentially  one  of 
negotiation  between  the  managers  of  individual  units,  respon- 
sibility centers,  and  their  superiors.   The  end  product  of  the 
negotiations  is  a  statement  of  the  outputs  that  are  expected 
during  the  budget  year  and  the  resources  that  are  to  be  used 
in  achieving  these  outputs. 

This  budget  is  a  bilateral  commitment.   Responsi- 
bility center  managers  commit  themselves  to  produce  the  plan- 
ned output  with  the  agreed  amount  of  resources  and  their 
superiors  commit  themselves  to  agreeing  that  such  performance 
is  satisfactory  unless  circumstances  change. 
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c.  Operating  and  Management 

During  the  period  of  actual  operations,  records 
are  kept  of  resources  actually  consumed  and  outputs  actually 
achieved.   The  records  of  resources  consumed  (costs)  are 
structured  so  that  costs  are  collected  by  program  and  by 
organization.   Program  costs  are  used  as  a  basis  for  future 
programming  and  organization  costs  are  used  to  measure  the 
performance  of  the  heads  of  organizational  units.   Related 
to  the  collection  of  information  is  the  process  of  internal 
auditing.   It  consists  of  procedures  intended  to  ensure  that 
the  information  is  accurate  and  that  the  opportunities  for  an 
undetected  departure  from  plans  and  policies,  and  for  theft  or 
defalcation  are  kept  to  a  minimum.   In  organizations  of  any 
size,  a  separate  internal  auditing  organization  exists  to 
ensure  adherence  to  these  procedures. 

d,  Reporting  and  Analysis 

Accounting  information,  as  well  as  nonquantif iable 
and  nonmonetary  data  is  summarized,  analyzed  and  reported  to 
those  who  are  responsible  for  knowing  what  is  happening  in 
the  organization  and  for  improving  performance.   These  reports 
essentially  compare  planned  outputs  and  inputs  with  actual 
outputs  and  inputs. 

The  information  is  used  for  three  purposes:   as  a 
basis  for  coordinating  and  controlling  the  current  activities 
of  the  organization,  as  a  basis  of  evaluating  operational 
managers  performance,  and  as  a  basis  for  program  evaluation. 
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Thus  the  closed  loop  of  the  four  steps  of  a  management  control 
system  are  demonstrated  in  that  evaluation  of  actual  performance 
can  lead  back  to  the  first  step,  a  revision  of  the  program. 

Anthony  makes  some  generalizations  about  management 
control  systems  based  on  his  analysis.  [Ref.  24] 

A  formal  management  control  system  is  a  total  sys- 
tem in  the  sense  that  it  embraces  all  aspects  of  the  organiza- 
tion's operations.   Such  a  total  system  provides  information 
necessary  so  that  management  can  ensure  all  parts  of  the 
operation  are  in  balance  with  one  another. 

A  management  control  system  should  be  designed  so 
that  the  actions  it  leads  managers  to  take  in  accordance  with 
their  perceived  self-interest  are  also  actions  that  are  in  the 
best  interest  of  the  organization.   This  is  the  concept  of 
goal  congruence. 

A  management  control  system  is  built  around  a 
financial  structure  with  resource  expressed  in  monetary  units. 
Money  is  the  common  denominator  by  means  of  which  the  hetero- 
geneous elements  of  resources  can  be  combined  and  compared. 
Thus,  the  accounting  system  serves  as  a  unifying  core  for  all 
types  of  information.   Although  this  monetary  focus  is  central, 
nonmonetary  measures  are  also  important  parts  of  the  system. 

A  management  control  system  should  be  a  coordinated, 
integrated  system.   Data  collected  for  different  purposes 
should  be  reconcilable  with  one  another. 
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Even  though  the  controller  of  an  organization  is 
responsible  for  the  design  and  operation  of  the  management 
control  system,  decisions  about  management  control  should  be 
made  by  line  managers.   Their  judgments  are  incorporated  in 
the  approved  plans,  and  they  are  the  persons  who  must  influence 
others.   Staff  people,  such  as  the  controller, present  informa- 
tion that  is  useful  in  the  process.   However,  the  significant 
decisions  are  those  of  line  managers. 

Based  on  this  theoretical  background  of  the  ele- 
ments of  a  planning  and  control  system  and  the  process  of 
management  control,  the  following  sections  will  compare  the 
establishment  of  systems  of  internal  control  in  the  private 
and  public  sector. 

C.   ESTABLISHMENT  OF  A  SYSTEM  OF  INTERNAL  CONTROL  IN  THE 
PRIVATE  SECTOR 

As  organizations  strive  to  attain  their  objectives,  manage- 
ment is  responsible  for  establishing  and  maintaining  its  system 
of  internal  controls  in  order  to  provide  reliable  data,  safe- 
guard assets  and  records,  promote  operational  efficiency,  and 
encourage  adherence  to  prescribed  policies. 

1 .   Transaction  Cycles 

Since  the  independent  auditor  places  primary  emphasis 
on  the  first  two  of  the  above  concerns,  in  establishing  its 
system  of  internal  control,  the  private  sector  firm  emphasizes 
the  general  objectives  of  authorization,  accounting,  and  asset 
safeguarding  to  ensure  the  prevention  of  errors  in  the  recording 
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of  economic  transactions.   These  general  goals  are  tailored  to 
meet  specific  objectives  within  each  financial  transaction 
cycle  of  a  particular  company.   Transaction  cycles  are  the 
processes  used  to  initiate  and  perform  related  activities, 
create  the  necessary  documentation,  and  gather  and  report 
related  data.   Traditionally,  there  are  five  of  these  cycles 
within  the  private  sector: 


CYCLE 


1 .   REVENUE 


2. 


3. 


EXAMPLES  OF  AREAS  INVOLVED 

Customer  acceptance,  credit,  shipping,  sales, 
sales  deductions,  cash  receipts,  receivables, 
allowance  for  doubtful  accounts,  accounting 
for  warranties,  etc. 


EXPENDITURE   Purchasing,  payroll,  cash  disbursements, 
accounts  payable,  accrued  expenses,  etc. 


PRODUCTION 

or 

CONVERSION 


4.   FINANCING 


Inventory  valuation,  property  accounting, 
cost  of  sales,  etc. 


EXTERNAL 

FINANCIAL 

REPORTING 


Capital  stock  and  debt,  investments,  treasury 
stock,  stock  options,  dividends,  etc. 

Preparation  of  financial  statements  and  related 
disclosures  of  other  financial  information, 
including  controls  over  financial  statement 
valuation  and  estimation  decisions,  selec- 
tion of  accounting  principles,  unusual  or 
nonrecurring  activities  and  decisions,  and 
those  which  are  not  transactional  in  nature, 
such  as  contingencies.  [Ref.  25] 

Figure  6  shows  the  flow  of  financial  transactions 

for  each  of  these  cycles  and  the  interrelationship  between 

them.   Some  firms  use  a  smaller  or  larger  number  of  these 

cycles . 
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Investments 
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Figure    6 
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2.   Specific  Control  Objectives  and  Procedures 

Within  the  revenue  cycle,  specific  control  objectives 
with  specific  control  procedures  and  techniques  to  ensure  they 
are  met  are  illustrated  here: 

REVENUE  CYCLE 
Specific  Objectives  Control  Procedures  and  Techniques 

Authorization  Objectives 


Types  of  goods  and  services 
to  be  provided 

Credit  terms  and  policies 
should  be  properly 
authorized 


-  Authorization  procedures  for 
nonstandard  goods  or  services 

-  Established  credit  policies 

-  Policies  for  investigating 
customer  credit  worthiness 

-  Periodic  review  of  credit 
limits 


Accounting  Objectives 


Deliveries  of  goods  and 
services  should  result  in 
preparation  of  accurate 
and  timely  billing  forms. 


-  Procedures  to  account  for  all 
shipments  and  comparison  of 
shipments  and  billings. 

-  Independent  checks  of  quantity 
of  goods  shipped. 


Asset  Safeguarding  Objectives 


Access  to  cash  receipts  and 
related  records  should  be 
controlled  to  prevent  un- 
recorded cash  receipts  or 
abstraction  of  recorded 
cash  receipts 


-  Independent  control  of  cash 
receipts  (lock  box,  cash 
register) 

-  Restrictive  endorsement  of 
checks  upon  receipt 

-  Segregation  of  duties:   cash 
receipts,  recording  of  sales, 
customer  credits,  accounts 
receivable.  [Ref.  27] 
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3.   Elements  of  Internal  Control 

Factors  that  shape  the  internal  accounting  control 

environment  include: 

a  well-defined  organization  plan  with  clear  lines  of 
authority  and  responsibility 

competent,  trustworthy  personnel 

adequate  segregation  of  duties 

proper  procedures  for  authorization 

adequate  documents  and  records 

physical  controls  over  assets  and  records 

independent  checks  on  performance. 

Along  with  a  proper  functional  division  of  the  activi- 
ties of  an  organization,  responsibility  for  the  performance  of 
duties  must  be  specifically  assigned  so  that  accountability 
can  be  maintained  and  corrective  action  implemented  as 
necessary. 

The  careful  selection  of  competent,  trustworthy  person- 
nel cannot  be  overemphasized.   Honest,  efficient  people  can 
perform  at  a  high  level  even  when  few  other  controls  are 
operational. 

Adequate  segregation  of  duties  includes  the  separa- 
tion of  the  following  functions:   authorization  of,  accounting 
for,  custody  of,  and  recordkeeping  duties  related  to  assets. 
An  organization  structure  that  allows  this  separation  of  duties 
will  lessen  the  likelihood  of  fraud  but  opportunities  still 
exist  for  collusion  or  management  override. 
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Each  transaction  must  be  properly  authorized.   General 
authorizations  allow  employees  to  process  transactions  within 
the  limits  set  by  management  policy.   Specific  authorizations 
are  applied  to  individual  transactions  where  approval  is 
granted  on  a  case-by-case  basis. 

Documents  and  records  are  the  physical  objects  upon 
which  transactions  are  entered  and  summarized.   They  serve  to 
transmit  information  through  an  organization  and  to  other 
organizations.   The  documents  must  provide  reasonable  assurance 
that  assets  are  properly  controlled  and  transactions  are  cor- 
rectly recorded. 

The  most  important  type  of  protective  measure  for 
safeguarding  assets  and  records  is  the  use  of  physical  controls 
such  as  inventory  storerooms,  safes,  backup  records. 

The  requirement  for  internal  verification  arises 
because  a  system  tends  to  change  over  time  unless  there  is  a 
mechanism  for  frequent  review.   Personnel  are  likely  to  forget 
procedures,  become  careless,  or  intentionally  fail  to  follow 
them  unless  someone  is  there  to  observe  and  evaluate  their 
performance.   Fraudulent  and  unintentional  errors  are  always 
possible  regardless  of  the  quality  of  the  controls.   It  is 
important  that  internal  verification  be  done  by  a  person 
independent  of  the  original  preparer  of  the  data.   A  "built-in" 
system  of  internal  verification  includes  the  separation  of 
duties  previously  discussed. 
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4 .   Internal  Audit  Function 

An  internal  audit  staff  is  widely  used  by  larger  firms 
to  review  their  internal  control  system.   This  organization 
performs  many  of  the  same  investigative  and  evaluative  func- 
tions of  the  independent'  auditor.   The  primary  difference  is 
that  this  staff  is  not  independent  of  management  whereas  the 
independent  auditor  must  be  so  in  order  to  remain  credible 
with  third  parties.   Although  the  independent  auditor  is  not 
permitted  to  rely  entirely  on  evidence  accumulated  by  internal 
auditors,  the  existence  of  an  adequate  staff  can  greatly  reduce 
the  evidence  he  must  gather  during  his  external  audit. 

An  important  point  should  be  noted  here:   the  internal 
control  system  itself  is  a  preventive  measure;  internal  auditors 
review  the  operation  of  an  implemented  system,  a  detection 
measure.   With  an  effective,  efficient  system,  there  should  be 
few  adverse  findings  by  an  internal  audit  staff. 

These  elements  of  internal  control  were  originally 
defined  in  1948  and  were  reaffirmed  by  the  Special  Advisory 
Committee  on  Internal  Control  in  1979. 

D.   ESTABLISHMENT  OF  A  SYSTEM  OF  INTERNAL  CONTROL  IN  THE 
PUBLIC  SECTOR 

As  in  the  private  sector,  management  in  executive  federal 

agencies  is  responsible  for  establishing  and  maintaining 

internal  control  systems  which  prevent  the  occurrence  of 

potential  risks  in  a  cost  effective  manner. 
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The  public  sector  has  relied  heavily  on  procedures  estab- 
lished for  commercial  business. 

1 .   Event  Cycles 

The  first  step  in  the  public  sector  in  setting  up  a 
system  of  internal  control  is  the  identification  of  event 
cycles.   This  is  the  same  concept  as  the  financial  transaction 
cycles  within  the  private  sector  but  it  has  been  expanded  by 
the  OMB  Guidelines  for  the  Evaluation  and  Improvement  of  and 
Reporting  on  Internal  Control  Systems  in  the  Federal  Government 
to  include  each  program  and  administrative  function  performed 
within  an  executive  agency  or  component  of  it.   Appendix  B  of 
the  Guidelines  presents  a  list  of  a  limited  number  of  event 
cycles  commonly  found  in  federal  agencies  along  with  suggested 
specific  internal  control  objectives  for  each  one.   Unfortunately, 
this  appendix  does  not  provide  corresponding  control  techniques 
to  ensure  the  objectives  are  met.   Such  information  would  be 
helpful  for  these  specific  objectives  and  serve  as  a  basis  for 
extrapolation  to  design  internal  control  review  processes 
that  are  appropriate  for  each  organization's  specific  objec- 
tives within  its  unique  transaction  cycles. 

Arthur  Andersen  &  Co.  suggests  an  alternative  method 
of  organizing  the  events  that  affect  each  agency: 
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CYCLE  EXAMPLES  OF  AREAS  INVOLVED 

1.  POLICY  AND  Policy  and  plans  are  developed 
PLANNING 

2.  BUDGET  Budget  is  approved,-  appropria- 

tions and  allotments  are  made 

3.  PROGRAM  Resources  are  used  to  accomplish 

agency  missions. 

4.  ADMINISTRATIVE  Resources  needed  for  programs 

are  acquired  and  controlled 

5.  REPORTING  Previous  events  are  summarized 

and  reported.  [Ref.  28J 

The  interrelationships  of  these  cycles  are  shown  in  figure  7. 

Within  this  proposed  methodology,  there  are  numerous 
program,  or  mission  cycles:   grants,  loans,  income  security, 
defense,  regulatory,  law  enforcement,  research  and  development, 
information  and  intelligence,  taxation,  insurance,  production 
of  goods  and  services,  and  construction;  as  well  as  a  number 
of  administrative  cycles:   personnel,  procurement,  disburse- 
ments, receipts,  asset  and  liability  management,  and  adminis- 
trative support. 

Figure  8  parallels  the  similar  picture  from  the  private 
sector,  illustrating  the  flow  of  transactions  and  the  inter- 
relationships between  them. 

2 .   Specific  Control  Objectives  and  Procedures 

To  further  relate  these  ideas  to  the  previous  discus- 
sion of  the  private  sector,  specific  control  objectives  with 
their  specific  control  procedures  or  techniques  for  the  defense 
program  cycle  are  shown  here. 
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Figure     8 


[Ref.    30] 
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Policy  &  Planning  Cycle 

Define  Objectives 
Prepare  plans 
Define  policies 
Operational  decisions 
Asset  Safeguarding  Measures 
Authorize  Transactions 
Processing 

Substantiate,  Evaluate 
Reports 


B.   Budget  Cycle 

Plan,  schedule  process 

Develop  forms 

Train 

Coordiante  personnel 

Consolidate  data 

Submit  budget 

Control  &  communicate  changes 

Distribute  approved  budget 

Monitor  budget  vs  actual 


Program  Cycle 


D.   Administrative  Cycle 


Planning 

Resource  Requisition 

Develop  Standards  for  Program 

Execution 
Management  of  resources 
Monitor  Accomplishment  of 

Program  Objectives 
Redirection  of  Resources  as 

needed 


Draft  Bid  Requests 

Advertise 

Evaluate  Bids 

Acquire  property,  goods  & 

services 
Receiving 
Quality  Control 


E.   Reporting  Cycle 

Record  Posting 

Gathering  of  Supplemental 

Information 
Transaction  Preparation 
Consolidation  of  Component 

Data 
Report  Preparation 


[Ref.  30] 


Figure  8 
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DEFENSE  PROGRAM  CYCLE 


Specific  Objectives 


Control  Procedures  or  Techniques 


Authorization 


Strategic  and  tactical 
defense  plans  should  be 
authorized  in  accordance 
with  laws,  regulations, 
treatires,  and  management 
policy. 

The  command,  base,  or  unit 
activities  should  be  auth- 
orized in  accordance  with 
laws,  regulations,  treaties 
and  the  strategic  and 
tactical  defense  plans 


The  deployment  of  forces  and 
weapons  should  be  authorized 
in  accordance  with  laws, 
regulations,  treaties  and 
tactical  plans. 


Operating  procedures  should 
be  established  and  maintained 
in  accordance  with 
management's  policy. 


All  plans  down  to  the  unit  and 
base  level  are  approved  by  the 
proper  command  level . 


Written  defintions  of  authorized 
activities  for  each  command, 
base  and  unit  are  provided  to 
commanders . 

Communication  of  strategic  and 
tactical  plans. 

Command  chain  is  defined  and 
followed. 

Communication  networks  are  used 
to  authorize  and  report  actions. 

Fail-safe  approvals  are  required 
for  critical  activities. 

Detailed  disposition  planning. 

Reports  of  unit  deployments. 

Reports  of  weapon  inventories 
are  made. 

Defined  operating  procedures. 

Training . 


Transaction  Processing* 


Only  those  requests  to 
utilize  weapons  and  troops 
that  are  in  accordance  with 
defense  plans  and  manage- 
ment's policy  should  be 
approved. 


Automated  systems  report  unit 
status. 

Systems  report  resources 
available. 
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Use  of  troops  and  weapons  in 
exercises  and  other  activi- 
ties should  be  accurately  and 
promptly  reported. 

Materials  and  supplies, 
ammunition,  fuel  and  other 
resources  used  in  conduct- 
ing exercises  and  other 
activities  should  be 
accurately  and  promptly 
reported. 


Cost  accounting  systems  linked 
to  operating  systems. 

Inspections  held. 

Physical  inventories  conducted 

See  above. 


See  above. 


Classification* 


Activities  carried  out  and 
related  costs  should  be 
accurately  classified, 
summarized,  and  reported. 


Changes  in  disposition  of 
troops  and  weapons  and 
related  costs  should  be 
accurately  applied  to  the 
proper  records. 

Costs  of  resources  utilized 
in  conducting  defense  acti- 
vities should  be  applied  in 
the  proper  accounting  period 
to  the  financial  systems. 


Cost  accounting  systems  that 
report  costs  of  resources  used 

Management  review  of  cost 
reports . 

Internal  audits  of  financial 
records. 

See  above. 


See  above. 


Physical  Safeguards^ 


Access  to  weapons  and 
resources  should  be  permit- 
ted only  in  accordance  with 
laws,  regulations,  treaties 
and  management's  policy. 


Arsenals  and  other  physical 
safeguards . 
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Access  to  records,  forms,      Military  police, 
processing  areas  and 

processing  procedures  should   Base  physical  access  controlled, 
be  permitted  only  in  accord- 
ance with  law,  regulation  [Ref.  31] 
and  management's  policy. 

*  Accounting  Objectives 

+  Asset  Safeguarding  Objectives 

3.   Standards  for  Internal  Controls  in  the  Federal 
Government 

The  FMFIA  requires  that  "  ...  internal  accounting  and 
administrative  controls  of  each  executive  agency  shall  be 
established  in  accordance  with  standards  prescribed  by  the 
Comptroller  General"  of  the  GAO.   The  definitive  standards 
were  issued  1  June  1983.   These  general  and  specific  standards 
are  a  melding  of  the  private  sector's  general  control  objec- 
tives of  authorization,  accounting  and  asset  safeguarding  and 
the  factors  that  shape  the  internal  accounting  control 
environment,  as  well  as  a  few  original  elements. 
a.   General  Standards 

CD  Reasonable  Assurance.   Control  systems  are  to 
provide  reasonable  assurance  that  the  objectives  of  the  system 
will  be  accomplished.   The  standard  recognizes  that  the  cost 
of  a  control  should  not  exceed  the  benefits  derived  therefrom 
and  that  the  benefits  consist  of  reductions  in  the  risks  of 
failing  to  achieve  the  stated  control  objectives.   This  evalua- 
tion of  costs  and  benefits  requires  estimates  and  judgments 
by  management. 
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(2)  Supportive  Attitude.   Managers  and  employees 
are  to  maintain  and  demonstrate  a  positive  and  supportive 
attitude  toward  controls  at  all  times. 

(3)  Competent  Personnel.   Managers  and  employees 
are  to  have  personal  and  professional  integrity  and  are  to 
maintain  a  level  of  competence  that  allows  them  to  accomplish 
their  assigned  duties ,  as  well  as  understand  the  importance 
of  developing  and  implementing  good  controls. 

(4)  Control  Objectives.   (Specific)  control  objec- 
tives are  to  be  identified  or  developed  for  each  agency  activity 
(program  or  administrative  function)  and  are  to  be  logical, 
applicable,  and  reasonably  complete. 

(5)  Control  Techniques.   Control  techniques  are 
to  be  effective  and  efficient  in  accomplishing  their  control 
objectives.   These  techniques  are  to  be  designed  to  accomplish 
the  specific  control  objectives  consistently.   When  in  place 
and  functioning  properly,  these  methods  and  procedures  prevent 
errors  and,  as  such,  can  be  considered  strengths  in  the  sys- 
tem of  internal  control. 

b.   Specific  Standards 

(1)  Documentation .   Control  systems  and  all  trans- 
actions and  other  significant  events  are  to  be  clearly 
documented  and  the  documentation  is  to  be  readily  available 
for  examination. 
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(2)  Recording  of  Transactions  and  Events.   Trans- 
actions and  other  significant  events  are  to  be  promptly 
recorded  and  properly  classified. 

(3)  Execution  of  Transactions  and  Events.   Trans- 
actions and  other  significant  events  are  to  be  authorized  and 
executed  only  by  persons  acting  within  the  scope  of  their 
authority.   Independent  evidence  is  to  be  maintained  that  proper 
authorizations  are  issued  and  that  the  transactions  conform 
with  the  terms  of  the  authorizations. 

(4)  Separation  of  Duties.   Key  duties  and  responsi- 
bilities in  authorizing,  processing,  recording,  and  reviewing 
transactions  should  be  separated  among  individuals.   Key 
duties  such  as  authorizing,  approving,  and  recording  trans- 
actions, issuing  or  receiving  assets,  making  payments,  and 
reviewing  or  auditing  are  to  be  assigned  to  separate  individ- 
uals to  minimize  the  risk  of  loss  to  the  government.   Internal 
management  control  depends  largely  on  the  reduced  opportunities 
to  make  and  conceal  errors  or  to  engage  in,  or  conceal 
irregularities.   This,  in  turn,  depends  on  the  assignment  of 
work  so  that  no  one  individual  controls  all  phases  of  an 
activity  or  transaction,  thereby  creating  a  situation  that 
permits  errors  or  irregularities  to  go  undetected. 

(5)  Supervision.   Qualified  and  continuous  super- 
vision is  to  be  provided  to  ensure  that  control  objectives  are 
achieved  and  to  ensure  that  approved  procedures  are  followed. 
Lines  of  personal  responsibility  and  accountability  are  to 

be  clearly  established. 
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(6)  Access  to  and  Accountability  for  Resources. 
Access  to  resources  and  records  is  to  be  limited  to  authorized 
individuals,  and  accountability  for  the  custody  and  use  of 
resources  is  to  be  assigned  and  maintained.   Periodic  compari- 
son shall  be  made  of  the  resources  with  the  recorded  account- 
ability to  determine  whether  the  two  agree.   The  frequency  of 
the  comparison  shall  be  a  function  of  the  vulnerability  of 
the  asset. 

c.   Audit  Resolution  Standard 

(1)  Prompt  Resolution  of  Audit  Findings.   Managers 
are  to  promptly  evaluate  findings  and  recommendations  reported 
by  auditors,  determine  proper  actions  in  response  to  audit 
findings  and  recommendations,  and  complete,  within  established 
timeframes,  all  actions  that  correct  or  otherwise  resolve  the 
matters  brought  to  management's  attention. 
4 .   Internal  Audit  Function 

As  mentioned  previously,  large  private  firms  maintain 
internal  audit  staffs  to  detect  breakdowns  in  their  internal 
control  systems.   Corresponding  functions  in  the  public  sector 
include  internal  review,  internal  audit,  and  the  inspector 
general. 

a.   Internal  Review 

Internal  Review  is  defined  by  SECNAVINST  7  510. 8A 
of  7  December  1982  as  the  conducting  of  audits,  studies, 
analyses,  or  evaluations  of  command  operations.   It  provides  a 
responsive,  independent,  in-house  means  to  detect  deficiencies, 
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improprieties,  or  inefficiencies,  and  to  provide  recommenda- 
tions to  correct  conditions  which  adversely  affect  mission 
accomplishment  or  command  integrity. 

Internal  reviews  can  be  used  in  any  operational 
or  functional  area  to  ensure  that  resources  have  been  em- 
ployed effectively,  efficiently,  and  within  legal  and  adminis- 
trative constraints.   As  stated  previously,  its  purpose  is  to 
detect  after-the-fact  deficiencies,  improprieties  and  inef- 
ficiencies as  opposed  to  the  preventive  objectives  of  internal 
control . 

The  ideal  placement  of  the  function  is  as  a  staff 
capacity  to  the  commanding  officer  to  ensure  independence  from 
operational  activities  and  objectivity  in  the  internal  evalua- 
tion of  the  organization. 

A  review  of  the  instruction  indicates  that  sections 
on  programming  for  internal  review  and  the  actual  conducting 
of  an  internal  review  are  closely  related  to  aspects  of  the 
internal  control  program  and  the  function  of  auditing 
respectively.   As  in  the  internal  control  program,  this  pro- 
gram requires  an  annual  activity  review  plan  to  provide 
adequate  coverage  for  functional  areas  with  known  or  suspected 
problems  and  components  must  prepare  an  inventory  of  review- 
able areas,  the  major  functions  performed  by  the  activity. 
Consideration  is  given  to  expected  benefits  of  a  review  and 
the  risk  associated  with  not  reviewing  an  area.   Priority  is 
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given  to  reviews  in  highly  vulnerable  functions,  those  activi- 
ties most  susceptible  to  fraud,  waste,  or  illegal  activity  as 
determined  by  command  vulnerability  assessments. 

The  actual  conduct  of  a  review  parallels  the 
steps  auditors  would  follow  in  their  examination  of  an 
organization.   Standards,  to  be  discussed  below,  are  speci- 
fied; reviews  address  financial,  compliance,  effectiveness 
and  efficiency,  or  program  issues  or  a  combination  of  these; 
reviews  evaluate  the  adequacy  of  internal  controls;  the  use 
of  audit  programs  addressed  to  specific  functional  areas  is 
encouraged;  working  papers  are  to  be  maintained,  the  review, 
reporting,  and  follow-up  procedures  all  rely  on  the  auditor's 
approach. 

SECNAVINST  7510. 8A  states  internal  audit,  func- 
tion of  the  Naval  Audit  Service,  and  internal  review  are  not 
duplicative,  but  rather  supplemental  to  each  other.   Within 
DON,  internal  audit  tailors  its  audit  coverage  in  recognition 
of  internal  review  evaluations.   Therefore,  internal  review 
efforts  complement,  rather  than  duplicate,  those  of  internal 
audit. 

bt   Naval  Audit  Service  (NAS) 

The  Auditor  General  of  the  Navy  has  responsibility 
for  the  Navy's  internal  audit  program. 

The  overall  objective  of  the  Naval  Audit  Service 
is  to  assist  Navy  managers  at  all  levels  in  the  effective 
discharge  of  their  responsibilities  by: 
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furnishing  objective  analyses,  appraisals,  recommenda- 
tions, and  pertinent  comments  concerning  the  activities 
and  programs  reviewed; 

determining  whether  prescribed  Navy  policies  and  pro- 
cedures in  any  area  of  operations  are  being  complied 
with; 

and  determining  whether  the  interests  of  the  Govern- 
ment are  being  adequately  protected. 

By  disclosing  the  existence  of  unauthorized  or 
improper  practices  and  the  causes  of  errors,  audit  provides 
protective  service  to  management.   When  management  policies 
are  found  to  be  ineffective  or  procedures  are  found  to  be 
uneconomical,  the  auditor  can  recommend  appropriate  action. 

Audit  reviews  all  aspects  of  operations  that 
involve  the  use  of  public  funds  or  resources  and  makes  rec- 
ommendations to  improve  the  efficiency  and  effectiveness  of 
operations. 

It  is  NAS  policy  to  conduct  audits  of  naval 
organizations  and  programs  on  a  mission-oriented  basis.   Other 
functions  are  examined  based  upon  the  degree  to  which  they 
support  mission  accomplishment. 

Comprehensive  audits  evaluate  the  adequacy  of 
policies  and  procedures,  the  effectiveness  and  efficiency  of 
operations  and  the  accuracy  of  records  and  reports  in  both 
mission  and  support  departments. 

c.   Inspector  General  of  the  Navy 

The  Inspector  General  Act  of  1978  formally  estab- 
lished this  function  which  basically  replicated  the  Service's 
auditing  and  internal  review  roles.   In  order  to  increase 
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economy  and  efficiency  in  the  executive  branch  of  the  govern- 
ment, the  Inspector  General's  basic  responsibilities  were 
defined. as : 

Conducting  and  supervising  audits  and  investigations 
relating  to  the  programs  and  operations  of  their 
agencies ; 

-    Providing  leadership  and  coordination  and  recommend- 
ing policies  for  other  activities  designed  to  promote 
economy  and  efficiency  and  prevent  and  detect  fraud 
and  abuse  in  such  programs  and  operations;  and 

Keeping  their  agency  head  and  the  Congress  informed 
about  the  administrative  problems  and  deficiencies 
and  the  necessity  for  and  progress  of  corrective 
actions . 

5 .   Standards  for  Audit  of  Governmental  Organizations, 
Programs,  Activities,  and  Functions 

All  three  of  the  above  programs  must  meet  the  Standards 
for  Audit  of  Governmental  Organizations,  Programs,  Activities, 
and  Functions  issued  by  the  Government  Accounting  Office  (GAO) . 

As  mentioned  in  Chapter  II,  the  AICPA  has  adopted 
standards  applicable  to  private  sector  audits  performed  to 
express  opinions  on  the  fairness  of  the  presentation  of 
financial  statements. 

GAO  has  incorporated  these  guidelines  into  its  own 
standards  for  government  audits  but  in  recognition  of  the 
broader  interests  of  many  users  of  government  audit  reports, 
has  also  included  additional  standards  for  expanded  scope 
audits . 

Officials  and  employees  who  manage  public  programs 
must  be  prepared  to  render  a  full  account  of  their  activities 
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to  public  officials,  legislators,  and  the  taxpaying  public. 
These  parties  are  interested  in  knowing  whether  government 
funds  are  properly  handled  and  in  compliance  with  laws  and 
regulations  and  whether  government  organizations  are  achiev- 
ing the  purposes  for  which  programs  were  authorized  and  funded 
and  are  doing  so  economically  and  efficiently. 

Therefore,  GAO's  standards  provide  for  the  concept  of 
expanded  scope  auditing  to  ensure  full  accountability.   The 
three  elements  of  expanded  scope  auditing  are: 

Financial  and  compliance,  determines:   whether  the 
financial  statements  present  fairly  the  financial 
position  and  whether  laws  and  regulations  that  have 
a  material  effect  upon  the  financial  statements  have 
been  complied  with. 

-   Economy  and  efficiency,  determines:   whether  resources 
are  being  managed  economically  and  efficiently,  the 
causes  of  inefficiencies  or  uneconomical  practices, 
whether  laws  and  regulations  concerning  economy  and 
efficiency  have  been  complied  with. 

Programs  Results,  determines:   whether  the  desired 
results  or  benefits  established  by  the  legislature 
or  other  authorizing  body  are  being  achieved  and 
whether  the  agency  has  considered  alternatives  that 
might  yield  desired  results  at  a  lower  cost.  [Ref.  32] 

Within  the  framework  of  the  three  elements  of  the 
concept  of  expanded  scope  audit,  the  various  AICPA  and  GAO 
standards  are  applied.   Internal  controls  are  mentioned 
specifically  as  described  below. 

If  a  particular  audit  is  focused  on  financial  and 
compliance  areas,  the  AICPA  auditing  standards  are  applicable 
with  the  following  additional  requirement  in  the  reporting 
area: 
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The  auditors  shall  report  on  their  study  and  evaluation 
of  internal  accounting  controls  made  as  part  of  the 
financial  and  compliance  audit.   They  shall  identify  as 
a  minimum:   (1)  the  entity's  significant  internal  ac- 
counting controls,  (2)  the  controls  identified  that 
were  evaluated,  (3)  the  controls  identified  that  were  not 
evaluated,  and  (4)  the  material  weaknesses  identified  as 
a  result  of  the  evaluation.  [Ref.  33] 

If  a  particular  audit  emphasizes  economy  and  efficiency 

or  program  results,  the  unique  GAO  examination  and  evaluation 

standard  requires  that: 

During  the  audit  a  study  and  examination  shall  be  made 
of  the  internal  control  system  (administrative  controls) 
applicable  to  the  organization,  program,  activity,  or 
function  under  audit.  [Ref.  34] 

A  corresponding  reporting  standard  for  government 

audits  of  economy  and  efficiency  or  program  results  requires 

that: 

The  report  shall  include  ...  a  description  of  material 
weaknesses  found  in  the  internal  control  system  (administra- 
tive controls) .  [Ref.  35] 

Thus  GAO  has  recognized  the  importance  of  administrative  and 
accounting  internal  controls  even  though  it  has  separated 
their  reviews  in  different  types  of  audits.   An  organization 
cannot  separate  its  controls  in  the  continuing  effort  to 
reach  its  objectives  through  effective  and  efficient  manage- 
ment of  its  resources. 

Recognizing  that  the  Navy's  instruction  on  internal 
control  is  quite  recent  but  also  noting  that  the  original 
OMB  guidance  was  published  in  October,  1981,  it  is  still 
unclear  how  these  similar  functions  relate  and  interact  with 
the  internal  control  program. 
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Office  of  the  Comptroller's  (NAVCOMPT)  letter  of 
2  July  8  2  stated  that  the  majority  of  internal  control  reviews 
are  to  be  performed  by  Navy  Audit  Service  (NAVAUDSVC)  and 
command  or  activity  internal  review  components;  SECNAV's 
letter  of  5  January  19  83  stated  that  personnel  performing 
internal  control  reviews  may  be  auditors;  internal  reviewers, 
inspectors,  supervisors,  etc.;  and  NAVCOMPT' s  letter  of 
5  April  83  provided  that  management  (changed  from  internal) 
control  reviews  were  to  be  performed  by  the  managers 
responsible.   It  is  not  surprising  that  activities  have  been 
confused  about  the  integration  of  these  functions. 

The  best  current  guidance  available  makes  these 
distinctions:   internal  reviews  are  more  structured,  are  done 
as  a  staff  function  to  the  commanding  officer  by  personnel 
independent  of  operational  responsibilities,  and  the  findings 
are  kept  within  the  command,  whereas  internal  control  reviews 
are  less  structured,  are  done  by  the  managers  involved  in  the 
program  or  administrative  function,  and  the  findings  are 
referred  up  through  the  chain  of  command.   Internal  review 
staffs  are  encouraged  to  provide  training  and  guidance  in 
the  design  and  review  of  internal  control  systems,  but  man- 
agers should  not  actually  establish  and  maintain  their  own 
systems  in  order  for  the  full  benefit  to  be  attained. 

Further  definitive  clarification  among  these  functions 
is  greatly  needed  to  distinguish  between  them  and  avoid 
duplication  of  effort. 
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E .  SUMMARY 

Reviewing  this  chapter,  it  is  clear  that  neither  CPA  firms 
nor  the  public  sector  has  really  integrated  its  internal 
control  system  in  the  broader  framework  of  management  control 
but  rather  have  chosen  to  emphasize  internal  accounting 
controls  which  are  closely  related  to  operational  controls. 
(Later  we  will  see  that  corporate  management  has  taken  the 
broader  approach  to  management  control.)   Such  a  system  does 
not  focus  on  the  wider  information  needs  of  managers  for 
administrative/  as  well  as  accounting,  data  necessary  to 
monitor  the  continuing  operations  of  an  organization  as  it 
strives  to  attain  program  and  financial  goals. 

It  is  recognized  that  each  organization  is  unique  and 
internal  controls  must  fit  the  particular  situation  but  all 
systems  should  be  integrated  in  the  broader  framework  of 
management  control. 

There  is  a  danger  of  attempting  to  adapt  the  financial 
auditing  literature  written  for  professional  auditors' 
limited  purposes  (CPA  audits)  since  these  writings  provide 
managers  with  little  enlightenment  for  their  decision  making 
and  planning  and  control  requirements. 

F.  LIMITATIONS  OF  INTERNAL  CONTROL 

Whether  in  the  public  or  private  sector,  the  establish- 
ment of  an  internal  control  system  can  provide  reasonable, 
but  not  absolute  assurance  that  the  organization's  activities 
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are  being  accomplished  in  accordance  with  its  specific 

objectives . 

In  SAS  No.  1,  the  AICPA  has  identified  internal  control 

limitations : 

In  the  performance  of  most  control  procedures,  there 
are  possibilities  for  errors  arising  from  such  causes 
as  misunderstanding  of  instructions,  mistakes  of  judg- 
ment, and  personal  carelessness,  distraction  or  fatigue. 
Furthermore,  procedures  whose  effectiveness  depends  on 
segregation  of  duties  obviously  can  be  circumvented  by 
collusion.   Similarly,  procedures  designed  to  assure  the 
execution  and  recording  of  transactions  in  accordance 
with  management's  authorizations  may  be  ineffective 
against  either  errors  or  irregularities  perpetrated  by 
management  with  respect  to  transactions  or  to  the  esti- 
mates and  judgments  required  in  the  preparation  of 
financial  statements.   In  addition  to  the  limitations 
discussed  above,  any  projection  of  a  current  evaluation 
of  internal  accounting  control  to  future  periods  is 
subject  to  the  risk  that  the  procedures  may  become 
inadequate  because  of  changes  in  conditions  and  that  the 
degree  of  compliance  with  the  procedures  may  deteriorate. 
[Ref.  36] 

Internal  control  must  be  dynamic  adapting  to  the  ever- 
changing  external  and  internal  environment  within  which  an 
evolving  organization  operates.   Loss  of  a  key  employee, 
introduction  of  a  new  function,  activation  or  de-activation 
of  an  activity  or  facility  are  all  events  requiring  a  decision 
to  determine  whether  existing  controls  should  be  reduced, 
increased,  or  simply  maintained. 

Considerations  of  cost/benefit  and  reasonable  assurance 
require  management  to  maintain  a  constant  awareness  of  sys- 
tem limitations  as  well  as  organizational  vulnerability  and 
risk.   The  direct  and  indirect  costs  of  excessive  controls 
can  far  outweigh  the  risks  of  adequate,  but  not  absolute, 

control. 
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IV.   REVIEW  OF  INTERNAL  CONTROL  SYSTEMS 

A.  INTRODUCTION 

This  chapter  will  compare  the  review  of  internal  control 
systems  as  done  in  both  the  private  and  public  sectors  and  thus 
demonstrate  the  closeness  of  the  procedures  despite  the  fact 
that  the  examinations  of  systems  were  originally  intended  to 
have  different  goals. 

B.  OVERVIEW  OF  AUDIT  PROCESS  IN  THE  PRIVATE  SECTOR 
1.   Study  of  the  Current  System 

The  private  sector  auditor  begins  his  review  of  the 
internal  control  system  by  obtaining  a  general  understanding 
of  the  client's  industry  and  the  client's  specific  business 
since  the  nature  of  that  business  affects  the  controls  a 
company  must  have  to  provide  reliable  financial  data  and  to 
safeguard  assets.   Interviews  with  the  chief  financial  officer 
and  other  key  personnel  help  the  auditor  develop  a  knowledge 
of  the  formal  internal  control  procedures  established  by  the 
firm.   A  detailed  organization  chart  and  the  procedures  manual 
are  useful  in  studying  the  prescribed  system.   The  data  ob- 
tained should  provide  an  overview  of  the  system. 

In  order  to  obtain  more  specific  information  about  the 
flow  of  documents  and  records  and  the  nature  of  specific 
internal  controls,  the  auditor  uses  flowcharts  and  internal 
control   questionnaires. 
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A  flowchart  provides  a  diagrammatic  representation 
of  the  client's  documents  and  their  sequential  flow  through 
the  organization.   The  origin,  subsequent  processing,  and 
the  final  disposition  of  each  record  is  illustrated.   The 
flowchart  also  provides  information  concerning  the  separation 
of  duties,  authorizations,  approvals  and  internal  verifica- 
tions that  occur  within  the  system,  as  well  as  facilitating 
the  identification  of  inadequacies  of  present  system  operations 

The  final  format  of  the  flowchart  should  describe  the 
system  and  procedures  actually  in  place  which  may  be  quite 
different  from  those  established  by  management.   Interviews 
with  involved  employees  and  auditor  observation  produce  this 
accurate  picture . 

After  the  flow  diagram  is  completed,  the  auditor 
selects  a  "sample  of  one"  of  each  source  document  described 
in  the  flowchart  and  follows  it  from  its  origin  to  its  final 
disposition  —  a  "walk- through"  test.   Increased  understanding 
of  the  system,  as  well  as  disclosure  of  errors  or  incomplete 
portions  of  the  flowchart,  are  benefits  gained  by  this 
procedure. 

An  internal  control  questionnaire  is  designed  to 
ask  a  series  of  questions  about  the  controls  in  each  audit 
area  as  a  means  of  indicating  to  the  auditor  aspects  of  the 
system  that  may  be  inadequate.   It  is  designed  to  require  a 
yes  or  no  response  with  a  no  response  indicating  potential 
lack  of  internal  control. 
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The  main  advantage  of  the  questionnaire  is  the  rela- 
tive completeness  of  coverage  of  each  audit  area  that  a  good 
survey  device  affords.   The  main  disadvantage  is  that  an 
overall  view  of  the  entire  cycle  is  not  provided. 

As  with  flowcharts,  it  is  important  to  determine 

whether  management's  prescribed  controls  are  actually  being 

followed . 

2 .   Preliminary  Evaluation  of  the  System  -  Compliance 
Testing 

Once  the  independent  auditor  understands  how  the 
internal  accounting  control  system  functions,  he  makes  a 
preliminary  assessment  of  existing  controls,  noting  strengths 
which  prevent  errors  and  weaknesses  which  permit  errors  or 
irregularities . 

This  preliminary  evaluation  is  done  for  each  financial 
transaction  cycle  on  an  individual  basis  by  testing  a  repre- 
sentative sample  of  documents  in  a  walk-through  test.   Internal 
control  techniques  or  procedures  should  have  been  established 
to  ensure  specific  control  objectives  are  met.   If  the  auditor 
finds  these  methods  in  place  and  operational,  he  can  assume 
that  information  generated  in  this  area  is  likely  to  be  correct 
and  therefore,  reduce,  not  eliminate,  the  extent  of  his  tests 
for  monetary  errors  (substantive  tests).   If  evidence  gathered 
indicates  that  internal  control  techniques  have  not  been 
established  or  are  not  functioning,  the  auditor's  expectation 
of  errors  in  that  area  rises  and  he  must  increase  the  amount 
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of  evidence  accumulated  to  ensure  that  the  potential  error 
is  immaterial.   It  is  during  this  phase  of  the  evaluation, 
called  compliance  testing,  that  the  auditor  identifies  material 
weaknesses  (Figure  9)  in  the  internal  control  systems. 

3 .  Substantive  Tests  of  Financial  Balances 
Substantive  audit  tests  are  tests  for  monetary  errors 

in  transactions  and  account  balances.   These  tests  are  partly 
based  on  the  auditor's  recognition  of  the  strengths  and  weak- 
nesses of  the  client's  internal  control  system  during  compliance 
testing.   These  further  tests  are  to  determine  whether  the 
ending  balances  and  footnotes  in  financial  statements  are 
fairly  stated.   Substantive  tests  reduce  the  risk  that  any 
material  errors  that  occur  will  not  be  detected  by  the 
examination. 

4 .  Reevaluation 

After  all  substantive  tests  are  completed,  the  auditor 
summarizes  his  findings  for  all  financial  transaction  areas 
to  determine  if  sufficient  evidence  has  been  accumulated  to 
issue  an  audit  opinion. 

5 .  Audit  Opinion 

The  type  of  audit  opinion  given  depends  on  the  results 
of  the  compliance  and  substantive  tests.   If  significant 
errors  have  been  found,  it  may  be  necessary  to  reevaluate  the 
quality  of  internal  control. 
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CONSIDERATIONS  OF  MATERIALITY  IN  THE 
PRIVATE  SECTOR 


The  concept  of  materiality  as  it  relates  to  auditing  is 
simply  that  the  auditor  should  concentrate  on  the  financial 
statement  information  that  is  important  . . .  more  likely  to  be 
significantly  misstated  ...  in  a  given  situation,  the  auditor 
must  establish  whether  the  account  or  transaction  under  con- 
sideration contains  errors  or  omissions  that,  when  combined 
with  other  possible  errors  in  the  statements,  will  make  the 
overall  financial  statements  misleading. 

Important  facets: 

Materiality  is  a  relative  concept  rather  than  an 
absolute  one. 

Net  income  is  the  usual  basis  for  evaluating 
materiality. 

The  combined  errors  are  more  important  than  errors  in 
individual  accounts. 

Accounts  with  small  recorded  balances  can  contain 
material  errors. 


Figure  9  [Ref.  37J 
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"As  companies  contiue  to  grow,  auditing  must  concentrate  on 
testing  management's  systems  of  controls  if  any  semblance  of 
audit  efficiency  is  to  be  maintained.   As  auditors  rely  more 
and  more  on  management's  control  systems,  they  must  develop 
a  more  pervasive  understanding  of  the  client's  business  and 
transactions.   Thus,  the  broader  definition  of  internal 
control  may  be  a  more  useful  approach  to  performing  an 
effective  independent  audit.  [Ref.  38] 


C.   OVERVIEW  OF  THE  REVIEW  AND  UPDATING  OF  PUBLIC  SECTOR 
INTERNAL  CONTROL 

OMB ' s  Guidelines  for  the  Evaluation,  Improvement  of  and 
Reporting  on  Internal  Control  Systems  in  the  Federal  Government 
of  December  1982  are  based  primarily  on  the  techniques  just 
described  for  use  by  independent  auditors  in  the  private 
sector  but  are  also  expanded  to  encompass  controls  necessary 
for  program  and  operational  activities.   In  light  of  the  recent 
revisions  to  pertinent  documents/  it  is  questionable  how  long 
this  expanded  view  will  last. 

Be  that  as  it  may,  the  public  sector  segments  the  review 
process  into  three  phases,  figure  10. 

1 .   Phase  1:  Organizing  the  Evaluation 

This  phase  includes  the  assignment  of  internal  control 
responsibilities  within  agencies  and  the  identification  of 
agency  components  and  programs  and  functions .   The  OMB  Guide- 
lines provide  general  instructions  in  these  areas  and  SECNAVINST 
5200.35  addresses  Navy  particulars. 

A  point  of  clarification  should  be  made  here:  The 
draft  DOD  Directive  defines  the  term  Assessable  Unit  as  an 
identified  function  within  an  organizational  unit  with 
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[Ref.  39] 
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significant  management  responsibilities.   Within  each  organiza- 
tional unit,  the  manager  is  responsible  for  developing,  main- 
taining, and  monitoring  a  system  of  management  control  regarding 
the  mission  function  and  the  common  management  functions 
within  the  organizational  unit  ...  this  approach,  a  combination 
of  organization  and  functions,  provides  for  an  efficient  span 
of  control  by  assigning  primary  responsibility  to  the  organiza- 
tion unit  manager  for  managing  the  process  (and)  performing 
management  control  reviews. 

According  to  SECNAVINST  5200.35  each  command  and 
activity  is  to  "  ...  select  the  programs/functions  which  repre- 
sent a  significant  level  of  effort  within  an  organization. 
These  major  areas  should  then  be  broken  down  into  (subprograms/ 
subfunctions)   which  are  the  aspects  of  the  major  area  per- 
formed by  the  command/activity.   For  example,  "Supply"  at  a 
field  activity  might  be  broken  down  into  warehousing,  SERVMART, 
shop  stores,  etc." 

2 .   Phase  2;  Vulnerability  Assessment 

A  vulnerability  assessment  is  a  management  evaluation 
of  a  program  or  function  aimed  at  identifying  the  potential 
for  mismanagement,  loss,  fraud,  or  waste  in  that  program  or 
function.   The  objective  of  these  assessments  is  to  attain  a 


The  Navy  Instruction  uses  the  term  assessable  units  here. 
In  light  of  DOD's  definition  above,  the  better  choice  of  words 
is:   subprograms/subf unction. 
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ranking  of  all  programs  and  functions  within  an  organization 
in  terms  of  their  susceptibility  to  loss  or  unauthorized  use 
of  resources,  errors  in  reports  or  information,  illegal  or 
unethical  acts  and/or  adverse  or  unfavorable  opinions. 

Steps  in  the  vulnerability  assessment  process  include: 

a.  Analysis  of  General  Control  Environment 

The  factors  used  here  are  drawn  directly  from  the 
GAO  document ,  Executive  Reporting  on  Internal  Controls  in 
Government  and  the  previously  mentioned  AICPA  document,  Report 
on  the  Special  Advisory  Committee  on  Internal  Accounting  Control 
They  include:   management  attitude,  organization  structure, 
personnel  delegation  and  communication  of  authority  and  respon- 
sibility, budgeting  and  reporting  practices,  and  organizational 
checks  and  balances. 

b.  Analysis  of  Inherent  Risk 

This  second  step  is  the  performance  of  an  analysis 
for  each  identified  program  and  administrative  function  of  the 
inherent  potential  for  waste,  loss,  unauthorized  use  or  mis- 
appropriation due  to  the  nature  of  the  program  or  function. 

c.  Preliminary  Evaluation  of  Safeguards 

A  preliminary  judgment  is  made  regarding  the 
existence  and  adequacy  of  internal  control  over  the  specific 
programs  and  administrative  functions  subject  to  the  guidelines. 
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d.   Summarizing  the  Results  of  Vulnerability  Assessments 
The  reviewer  makes  an  overall  assessment  of  the 
adherence  of  the  program  or  administrative  function's  internal 
control  system  to  at  least  some  of  the  prescribed  standards  and 
the  vulnerability  of  the  program  or  administrative  function 
itself.   The  process  and  results  must  be  documented  and  a 
conclusion  reached  as  to  overall  vulnerability,  e.g.,  highly 
vulnerable,  requiring  a  detailed  review  of  internal  controls; 
moderately  vulnerable,  permitting  less  intensive  and  less  fre- 
quent internal  control  reviews;  absence  of  vulnerability,  etc. 
Problems  or  weaknesses  requiring  immediate  correc- 
tive action  may  be  observed  during  the  performance  of  the 
vulnerability  assessments.   Such  situations  should  be  brought 
to  the  attention  of  the  appropriate  agency  official  as  soon 
as  possible  so  that  prompt  corrective  action  can  be  taken. 
3 .   Develop  Plan  for  Subsequent  Actions 

Completed  vulnerability  assessment  documents  are  trans- 
mitted to  and  maintained  by  the  DON  Review  and  Oversight 
Council  which  is  responsible  for  the  final  ranking  of  programs/ 
functions  for  DON  as  a  whole.   Upon  completion  of  each  biennial 
vulnerability  assessment,  the  Council  will  prescribe  a  minimum 
number  of  high  vulnerability  areas  which  must  be  reviewed  each 
year. 

Many  similarities  can  be  drawn  between  these  first  two 
phases  of  the  internal  control  review  process  in  the  public 
sector  with  the  independent  auditor's  study  and  preliminary 
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evaluation  of  the  client's  internal  control  system.   Again,  no 
specifics  are  provided  and  each  organization  must  develop 
procedures  useful  to  its  own  situation. 

4 .   Phase  3:  Conduct  Internal  Control  Reviews 

DON ' s  'instruction  describes  management  control  reviews 
(also  referred  to  as  internal  control  reviews)  as  detailed 
examinations  of  a  program/ function  to  ensure  internal  controls 
exist,  are  documented,  and  are  functioning  as  intended.   These 
reviews  should  identify  weak,  nonexistent,  or  excessive  con- 
trols and  initiate  actions  necessary  to  correct  noted 
deficiencies.   Management  control  reviews  are  performed  at 
each  DON  command  and  activity  by  the  manager  responsible  for 
the  system  of  internal  controls  under  review.   The  scope  of  a 
review  in  a  particular  program  or  function  should  be  commen- 
surate with  a  unit's  responsibility  in  that  area. 

This  process  is  closely  related  to  the  procedures  used 
by  the  independent  auditor  for  his  limited  purposes. 

The  following  steps  provide  the  basic  approach  to  per- 
forming reviews. 

a.   Identification  of  Transaction  Cycles 

If  an  effective  system  as  previously  described 
has  not  been  established,  then  the  processes  or  events  lead- 
ing to  accomplishment  of  a  program  or  function  must  be 
described.   An  organization  may  have  a  larger  or  smaller 
number  of  cycles  than  discussed  depending  on  its  unique 
situation. 
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b.  Analysis  of  General  Control  Environment 

These  are  the  same  general  controls  mentioned  in 
the  vulnerability  assessment  process.   If  this  analysis  was 
already  a  part  of  a  vulnerability  assessment,  then  a  review  of 
it  and  update  is  all  that  is  necessary. 

c.  Document  Transaction  Cycles 

As  in  the  private  sector,  flowcharts,  accompanied 
by  appropriate  narrative  descriptions,  facilitate  the  review 
of  current  internal  controls.   Procedures,  personnel,  and 
documents  and  records  involved  should  be  identified  through 
interviews  and  observation.   A  walk-through  test  is  advisable 
here  too. 

d.  Evaluate  Internal  Controls 

The  next  step  is  to  determine  if  needed  specific 
internal  control  objectives  and  corresponding  control  tech- 
niques are  in  place  for  each  transaction  cycle. 

Control  objectives  are  established  because  a  risk 
exists;  internal  control  techniques  are  implemented  to  prevent 
the  specific  risk  from  occurring.   Pertinent  examples  have 
been  provided  in  the  previous  section  which  discussed  the 
establishment  of  an  internal  control  system. 

Inherent  limitations  which  constrain  an  organiza- 
tion's effort  to  maintain  an  effective  system  include:   budget 
constraints,  statutory  or  regulatory  restrictions,  staffing 
limitations,  etc. 
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During  this  step  excessive  controls  should  be 
identified,  as  well  as  compensating  controls  —  those  which 
offset  a  weak  control. 

Results  of  this  step  include  an  identification 
of  necessary  internal  controls,  control  objectives  for  which 
better  control  techniques  are  needed,  and  unnecessary  controls 
that  may  be  eliminated, 

e.  Test  Internal  Controls 

This  step  is  similar  to  the  auditor's  compliance 
testing.   The  internal  control  techniques  are  tested  to  deter- 
mine whether  such  controls  are  functioning  as  intended.   Again, 
a  review  of  a  representative  sample  of  transactions  is  recom- 
mended to  see  whether  the  general  objectives  of  authorization, 
accounting  and  asset  safeguarding  are  met. 

During  this  process,  weaknesses  and  deficiencies 
in  the  internal  control  system  should  be  noted  and  corrective 
actions  considered. 

f.  Reporting  the  Results  of  Internal  Control  Reviews 
The "final  step  of  the  internal  control  review 

process  is  concerned  with  the  reports  which  should  result. 
(1)  Audit  Resolution  Standard.   To  comply  with 
the  Comptroller  General's  Audit  Resolution  Standard,  the 
results  should  be  reported  to  managers  so  they  may  evaluate 
the  findings  and  recommendations  and  initiate  appropriate 
corrective  actions  within  established  timeframes.   Reports 
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should  contain  an  identification  of  weaknesses  and  recommenda- 
tions to  correct  them. 

(2)  FMFIA  Statement.   Another  provision  of  the 
Act  of  19  82  requires  an  annual  statement  by  31  December  of 
each  year,  commencing  in  1983,  from  each  agency  head  to  the 
President  and  Congress  as  to  whether  the  agency  has  established 
a  system  of  internal  accounting  and  administrative  control  in 
accordance  with  the  standards  of  the  Comptroller  General  and 
whether  this  system  provides  reasonable  assurance  that  the 
FMFIA  objectives  are  met. 

The  collective  existence  of  the  below  listed 
elements  provides  evidence  that  management  and  other  person- 
nel throughout  the  organization  are  cognizant  of  the  import- 
ance of  internal  control  and  that  the  necessary  evaluation 
and  improvement  processes  are  taking  place: 

Responsibility  for  directing  the  program  is  assigned 
to  a  high  level  official 

Agency  internal  control  directives  and  regulations  are 
published  and  disseminated 

Documentation  of  the  conduct  and  results  of  assessments 
and  reviews  are  maintained 

Documentation  of  corrective  actions  taken  to  strengthen 
the  internal  control  systems  is  available 

Inclusion  of  internal  control  elements  in  performance 
appraisals 

Written  assurances  from  both  the  designated  senior 
official  responsible  for  coordinating  the  agency- 
wide  effort  and  the  heads  of  the  agency's  various 
organizational  units,  and  comments  from  the  Auditor 
General. 
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The  Act  also  requires  an  agency  to  include 
within  the  statement  to  the  President  and  Congress  a  report 
listing  identified  material  weaknesses  in  internal  accounting 
and  administrative  control  and  a  schedule  for  their  correction. 
A  material  weakness  (Figure  11)  is  a  situation  in  which  the 
designed  procedures  or  the  degree  of  operational  compliance 
therewith  does  not  provide  reasonable  assurance  that  the 
FMFIA  objectives  of  internal  control  are  being  accomplished. 

C3)  Report  on  Agency's  Accounting  System.   An 
accounting  system  is  an  integral  part  of  a  management  control 
system  since  the  accounting  records  and  related  procedures  can 
contribute  significantly  to  attaining  the  objectives  of  the 
control  system. 

Therefore,  a  separate  report  is  also  required 
by  the  FMFIA  attesting  to  whether  or  not  the  agency's  account- 
ing system  conforms  with  requirements  prescribed  by  the 
Comptroller  General. 

A  complete  accounting  system,  for  GAO  approval 
purposes,  is  one  established  to  assist  in  the  financial  manage- 
ment functions  of  budget  formulation  and  execution,  proprietary 
accounting,  and  financial  reporting.   It  is  the  total  struc- 
ture of  methods  and  procedures  used  to  record,  classify,  and 
report  information  on  the  financial  position  and  operations 
of  a  governmental  unit  or  any  of  its  funds,  balanced  account 
groups,  and  organizational  components.   Accounting  systems, 
for  approval  purposes,  shall  be  comprised  of  the  various 
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CONSIDERATIONS  OF  MATERIALITY  IN  THE  PUBLIC  SECTOR 

A  Material  Weakness  in  internal  accounting  and  administra- 
tive controls  is  a  condition  in  which  the  specific  control 
procedures  or  the  degree  of  compliance  with  them  do  not  reduce 
to  a  relatively  low  level,  the  risk  that  errors  or  irregulari- 
ties having  a  significant  affect  on  operations  may  occur  and 
not  be  detected  within  a  timely  period  by  employees  in  the 
normal  course  of  performing  their  assigned  functions.   In 
determining  what  has  a  significant  or  material  affect  on  opera- 
tions, a  command  should  consider  such  factors  as  the  amount  of 
assets  exposed  to  weaknesses,  the  number  of  times  errors  or 
irregularities  have  occurred  or  a  predictable  level  of  occur- 
rence based  on  historical  data,  the  range  and  distribution  of 
the  errors  or  irregularities,  the  effect  of  a  combination  of 
errors  or  irregularities  on  operations,  and  the  quality  of 
the  overall  control  environment. 

Judgment  must  be  exercised  in  deciding  whether  a  weakness 

in  internal  controls  is  material.   Some  common  sense  guidelines 

include: 

The  dollar  amount  involved 

Substantial  violations  of  program  directives  or  poor 
management  that  could  seriously  affect  program 
accomplishment 

Resultant  requirements  for  major  policy  changes  that 
effect  monetary  or  nonmonetary  benefits  at  the  DOD 
level 

The  position  and  degree  of  responsibility  held  by 
persons  involved 

Figure  11 
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The  number  of  persons  involved 

The  existence  of  extensive  minor  deficiencies  that  be- 
come significant  in  the  aggregate 

The  likely  degree  of  impact  upon  unit  readiness, 
security  or  morale 

The  degree  of  notoriety  likely  to  result 

The  existence  of  a  systematic  weakness  that  leaves 
DON  vulnerable  to  recurring  problems. 


[Ref.  40] 


Figure  11  (cont'd) 
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operations  involving  the  authorizing,  recording,  classifying 
and  reporting  of  financial  data  related  to  revenues,  expenses, 
assets,  liabilities,  and  equity.   For  each  of  these  operations, 
GAO  review  for  approval  will  evaluate  the  procedures  and 
processes  from  the  point  a  transaction  is  authorized  through 
processing  of  data  (either  manually  or  automatically)  to 
issuance  of  financial  and  management  information  reports  con- 
taining data  in  detail  or  summary  form. 
5 .   The  Burns  System 

To  digress  a  moment,  CAPT  J.  0.  Carlson,  Ms.  J.  W. 
Lewis,  and  Mr.  J.  F.  Smith,  Jr.  describe  an  innovative  method- 
ology for  the  design,  maintenance,  implementation,  and  evalua- 
tion of  a  network  of  internal  control  for  accounting  and 
financial  management  systems  developed  for  DON  by  Dr.  D.  C. 
Burns . 

The  best  possible  identification  of  all  threats 
against  the  system  is  developed.   A  threat  is  any  adverse 
impact  upon  the  organization  that  could  result  from  the 
operation  of  the  system.   The  potential  impact  of  the  threat 
is  quantified  in  dollar  terms.   Risks,  the  probability  or 
potential  of  the  threat  occurring,  associated  with  each 
threat,  are  then  developed  and  quantified.   The  identification 
of  all  possible  controls,  risk  reduction  processes  or  actions 
(internal  control  techniques) ,  that  could  apply  to  the  threats 
is  performed.   These  controls  may  be  manual  or  automated  and 
can  be  internal  or  external  to  the  system  or  organization. 
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The  best  possible  determination  of  the  percentage  of  effective- 
ness provided  by  each  control  against  each  threat  is  made, 
recognizing  that  it  is  possible  for  the  effectiveness  of  each 
control  to  be  different  for  different  threats.   The  benefits, 
the  result,  in  dollar  terms,  of  applying  a  control  against 
each  threat,  are  then  determined.   This  is  done  by  multiplying 
the  quantified  threat  by  the  risks  and  again  multiplying  this 
result  by  the  effectiveness  of  the  control.   The  result  is 
threats,  risks,  and  benefits  quantified  in  dollar  terms, 
Figure  12. 

Since  controls  are  threat-specific,  the  action  of  all 
controls  against  a  given  threat  must  be  developed  along  a 
specific  control  path  for  each  threat.   This  path  shows  threat- 
specific  relationships  and  control  effectiveness,  Figure  13. 

The  next  step  is  to  develop  a  matrix  of  threats  to 
controls.   This  shows  the  possible  network  of  controls  for 
the  system.   The  costs  of  each  control  are  identified.   This 
results  in  the  cost  benefit  relationship  of  the  network  of 
controls,  Figure  14.   Since  the  Burns  System  uses  a  Threat/ 
Control  Matrix,  the  application  of  the  control  costs  shows 
not  only  the  cost  of  a  control  for  each  threat,  but  the 
comparison  of  the  cost  of  that  control  to  the  benefits  of  its 
application  against  all  relevant  threats. 

The  matrix  is  then  analyzed  in  one  or  more  of  a 
variety  of  ways.   The  best  possible  unrestricted  cost  bene- 
ficial network  of  controls,  the  best  network  of  controls 
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THREAT 


BASIC  COMPONENTS  OF  THE  BURNS  SYSTEM 


CONTROL  FUNCTION* 


UNCONTROLLED 
RISK 


$  Y 


STATISTICS  /  ESTIMATES 

$  X  =  AMOUNT  OF  RISK  POSED  BY  THE  THREAT  TO  BE  CONTROLLED 

$  Y  =  AMOUNT  RISK  CONTROLLED 

$  Z  =  AMOUNT  OF  UNCONTROLLED  RISK 

%   =  OPERATING  CAPABILITY  OF  CONTROL  TO  REDUCE  THREAT- 
SPECIFIC  RISK,  EXPRESSED  IN  PERCENT  TERMS 


*  CONSIDERS  BOTH 

-  INTERNAL  AND  EXTERNAL  CONTROLS 

-  MANUAL  AND  AUTOMATED  PROCESSES 


Figure  12 


[Ref.  40] 
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EACH  CONTROL  POINT/PROCESS  HAS 
A  UNIQUE  EFFECT  ON  A  SPECIFIC  THREAT 


$20,000 


31,080 


$4,000 


$1,200 


1972 


($16,000) 


($2,800) 


($120)     ($108) 


$3,000 


0 


$10,000 


$1,080 


$1,200 


$918 


($7,000)   ($1,800) 


($120)      ($162) 


,$1  ,,5QQ 


0 


$5,000 


$1,140 


($3,500)    ($75)     ($285) 


AGGREGATE    SUMMARY 


$35,000       $19,000       $12,000       $7,400  $3,900       $3,585 


N/AW3  0  30 
($16,000*)   '($7,000)   '($4,600*)    '($3,50  0*)  '($315)  *     ($555)        ($31,920) 


Figure    13 


[Ref.    41] 
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under  a  given  cost  restriction,  or  any  similar  scenario  can 
be  identified.   A  variety  of  sensitivity  analysis  simulations, 
changing  any  one  or  combination  of  variables  (e.g.:  risk, 
percentage  of  effectiveness,  etc.)  can  be  performed.   All  of 
this  is  expressed  in  dollar  terms,  supported  by  documentation 
produced  with  automated  support. 

This  approach  can  be  useful  in  the  design  of  cost 
beneficial  networks  of  accounting  and  financial  management 
controls,  as  well  as  in  the  identification  and  evaluation  of 
existing  networks  of  controls. 

It  should  be  recognized  that  this  approach  is  limited 
to  areas  of  control  which  can  be  quantified.   It  is  a  less 
useful  method  for  evaluating  controls  in  program  and  opera- 
tional areas  where  quantitative  data  is  limited  or  nonexistent 
This  system  reverts  to  the  limited  scope  of  the  independent 
auditor's  review  of  financial  data  and  asset  safeguarding 
measures.   It  is  not  designed  to  consider  the  internal  admin- 
istrative controls  which  are  also  an  important  part  of 
management's  concern.   However,  if  OMB  &  DOD  do  move  in  the 
direction  of  focusing  on  internal  accounting  controls,  this 
methodology  will  have  useful  applications. 

D.   CONCLUSION 

A  point  requires  consideration  here:   Is  the  auditor's 
framework  used  for  the  review  of  accounting  controls  neces- 
sarily adequate  for  the  broader  emphasis  on  administrative, 
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as  well  as  accounting,  controls  originally  intended  by  OMB 
and  DOD?   More  appropriate  guidance  should  stress  the  review 
of  management  controls. 

Again,  specific  guidance  is  not  provided  on  how  to  review 
internal  control  systems  either  in  the  public  or  private 
sector.   In  large  organizations,  whether  profit  or  nonprofit, 
broad  direction,  which  must  be  adapted  to  each  situation, 
makes  the  coordination  and  summarization  of  the  nonuniform 
reports  into  a  single,  cohesive  statement  difficult. 
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V.   INTERNAL  CONTROL  -  A  MANAGEMENT  EMPHASIS 

A.   INTRODUCTION 

Both  the  private  and  public  sector  originally  accepted 
the  broad  interpretation  of  the  concept  of  internal  control. 
In  the  private  sector,  however,  independent  auditors  success- 
fully limited  the  scope  of  their  responsibility  to  internal 
accounting  control.   Even  the  AICPA  recognized  that  this 
definition  was  inadequate  for  management's  purposes  since 
corporate  executives  should  be  concerned  with  all  of  the 
controls  contemplated  in  the  inclusive  definition  of  1949. 

Within  the  federal  government,  efforts  to  establish 
internal  control  systems  have  been  grounded  on  CAP ' s  broad 
interpretation  of  1949.   An  attempt  has  been  made  to  utilize 
the  professional  auditing  literature,  originated  for  the  narrow 
purpose  of  internal  accounting  control,  and  expand  it  to 
include  program  and  operational  functions  as  well.   Now  OMB 
and  DOD  have  revised  their  definition,  moving  backwards  and 
much  closer  to  the  idea  of  internal  accounting  control.   It 
is  unclear  how  this  revision  will  affect  the  establishment 
of  an  internal  control  system  which  covers  the  entire  spectrum 
of  an  organization's  functions.   But  one  thing  is  certain, 
such  terminology  changes  serve  to  create  confusion.   And  it  is 
to  be  hoped  that  federal  managers  will  come  to  recognize  their 
concerns  can  only  be  encompassed  in  the  1949  AICPA  statement. 


92 


B.   "INTERNAL  CONTROL  —  A  MANAGEMENT  VIEW" 

As  part  of  a  larger  study  on  internal  control  in  U.S. 
corporations,  Dr.  R.  K.  Mautz  and  B.  J.  White  wrote  an  article, 
"Internal  Control  —  a  Management  View,"  which  proposes  a 
tentative  managerial  definition  of  internal  (accounting)  con- 
trol and  briefly  attempts  to  integrate  it  within  the  frame- 
work of  the  Planning  and  Control  process  found  in  organizations 
Although  the  writing  is  addressed  to  the  private  sector,  many 
of  the  ideas  are  useful  for  public  sector  managers,  as  well, 
and  thus  will  be  discussed  here. 

Management's  interest  in  internal  control: 

...  is  likely  to  emphasize  the  positive  aspects  of  internal 
control  measures  ...  (management  is)  interested  not  only 
in  the  prevention  of  errors  and  irregularities  but  also 
in  the  active  accomplishment  of  the  company's  objectives. 
The  purpose  of  control  is  to  get  things  done  . . .  manage- 
ment ' s  interest  is  more  likely  to  run  to  activities  to 
be  performed,  resources  to  be  utilized  and  information 
essential  for  operational  use  than  would  the  interests 
of  an  auditor  concerned  with  the  propriety  of  financial 
statements  for  external  use.   The  totality  of  management 
control  is  coextensive  with  company  operations.   Manage- 
ment's controls  are  intended  to  plan,  initiate,  encourage, 
guide  and  evaluate  the  company's  activities.   Any  steps  ... 
influencing  operations  in  order  to  accomplish  the  company's 
objectives  can  be  included  in  the  total  control  system. 
[Ref.  44] 

Mautz  and  White  see  internal  (accounting)  control  as  an 
addition  to  basic  operations  --  measures  taken  to  avoid  errors 
and  irregularities  while  operations  are  in  progress.   Opera- 
tions could  continue  without  internal  accounting  control, 
although  perhaps  not  as  effectively.   Without  management 
control,  however,  operations  could  not  exist. 
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These  authors  view  control  as  necessary  to  see  that: 

employees  perform  certain  actions  that  will  have  a 
positive  effect  in  accomplishing  the  company's 
objectives 

employees  do  not  engage  in  activities  that  would  be 
dysfunctional  in  accomplishing  those  objectives 

the  company's  assets  are  used  for  the  purposes 
intended,  and  no  others. 

Internal  (accounting)  control  makes  much  of  the  safeguarding 

of  assets.   From  a  management  perspective,  Mautz  and  White  see 

this  concern  as  less  important  than  utilizing  assets  in  ways 

appropriate  to  attaining  the  organization's  goals.   There  is 

a  great  deal  of  similarity  between  the  above  and  Anthony's 

planning  and  control  framework. 

Balance  sheet  assets  are  not  the  only  resource  to  be 
protected  from  improper  use.   A  company's  credit  is  a  resource 
as  is  its  ability  to  raise  funds.   Therefore,  the  authors 
suggest  the  use  of  the  phrase  'utilization  and  conservation 
of  resources'.   It  avoids  the  rather  sterile  protective 
implication  of  safeguarding  and  is  broad  enough  to  include 
internal  control  measures  for  liability  and  equity  items  as 
well. 

Management  has  a  dual  control  problem  with  information. 
It  must  assure  an  adequate  supply  of  reliable,  timely  informa- 
tion to  the  members  of  the  operating  management  . . .  Management 
also  has  a  responsibility  to  maintain  its  access  to  the 
capital  market  and  ...  to  meet  legal  requirements  by  issuing 
interim  and  annual  financial  statements  . . .  auditors  tend 
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to  think  of  internal  control  as  concerned  primarily  with  this 
external  financial  reporting. 

Mautz  and  White  next  propose  a  conceptualization  of 
management  control  with  ideal  employees:   assume  a  set  of 
conditions  in  which  management  need  have  no  concern  for 
internal  errors  or  irregularities  since  all  employees  are 
efficient,  prudent,  honest,  loyal,  informed,  and  none  are 
susceptible  to  lapses  of  any  kind.   With  essential  instruc- 
tion and  guidance,  they  are  competent  and  serious  in  attempt- 
ing to  perform  in  accordance  with  company  policies,  objectives, 
and  plans.   In  such  a  situation,  the  elements  of  a  management 
control  system  would  include  only  control  measures  essential 
to  operations: 

establishment  of  objectives  (policy)  for  the  company 
and  its  operating  components  (conventional  function 
of  the  board  of  directors) 

communication  of  objectives  to  those  responsible 
for  implementation 

implementation  (.management  function) 

Planning  operations  to  achieve  objectives 

Instructing  employees  about  expected  performance 

Performance 

Review  of  accomplishment  and  consideration  of  need 
for  modification  of  plans  and  policies. 

The  authors  suggest  additional  elements  since  employees 

are  human  and  subject  to  faults  and  failings: 
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Supervision  to  provide  reasonable  assurance  that 
employees : 

perform  the  activities  for  which  employed  and 
do  not  undertake  actions  detrimental  to  the 
accomplishment  of  stated  objectives 

utilize  and  conserve  the  company's  resources 

provide  an  adequate  supply  of  reliable,  timely 
information  for  internal  management  purposes  and 
prepare  periodic  financial  statements. 

To  ensure  employee  failure  does  not  occur,  Mautz  and 
White  suggest  specific  practices  and  procedures  tailored  to 
a  company's  activities  which  would  be  included  in  the  manage- 
ment control  system: 

Establishment  of  objectives  for  the  company  and  its 
operating  components 

Communication  of  objectives  to  those  responsible 
for  implementation 

Implementation 

planning  operations  to  achieve  objectives 

instructing  employees  on  performance 

performance,  including  supervision  of  performance 

Utilization  of  precautions,  incentives,  and  deterrents 
to  reduce  the  probability  of  errors  and  irregularities 
and  of  measures  to  detect  the  existence  of  errors  and 
irregularities  if  these  have  occurred 

Reviews  of  accomplishments  and  consideration  of  the 
need  for  modification  of  plans  and  policies  for: 

effect  of  outside  forces 

any  action  needed  to  reduce  the  probability  of 
internal  errors  and  irregularities. 
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Thus,  internal  (accounting)  control  measures  fit  within 
the  management  control  system  and  become  a  part  of  it  once 
the  assumption  that  employees  are  subject  to  errors  and 
irregularities  is  accepted. 

Mautz  and  White  define  internal  (accounting)  control  as  ... 
those  measures  employed  by  management  to  attain  the  objectives 
of  the  enterprise  that  would  be  unnecessary  if  all  personnel 
were  competent  and  trustworthy  . . ,  measures  to  remind  per- 
sonnel ...  of  their  duties,  to  encourage  efficiency,  prudence, 
loyalty,  and  to  provide  for  timely  discovery  of  errors  ... 

Internal  (accounting)  control  is  recognized  as  part  of 
the  total  management  control  system  --  measures  employed  by 
management  to  obtain  the  objectives  of  the  enterprise.   It 
constitutes  an  identifiable  subset  of  these  measures.   At 
the  same  time,  the  proposed  definition  does  not  encompass  any 
part  of  policy  formation  (strategic  planning)  or  operational 
planning  (operational  control) . 

Finally,  Mautz  and  White  state  that  although  it  is  separate 
from  policy  formation  and  operational  planning,  internal 
(accounting)  control  leans  heavily  on  these  elements  of 
management  control  for  meaning.   It  could  not  be  evaluated 
effectively  all  by  itself.   Unless  policy  goals  in  the  form  of 
reasonably  specific  objectives  are  known,  there  can  be  no 
measures  to  attain  them.   Unless  operating  plans  exist, 
supervision  of  performance  loses  its  meaning.   Internal 
accounting  reports  must  recognize  that  both  objectives  and 
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plans  to  achieve  them  (internal  administrative  controls)  are 
highly  relevant  to  the  purpose  of  reporting,  and  from  a 
management  viewpoint,  one  aspect  of  external  reporting  is  to 
show  how  well  the  company  has  met  its  objectives. 

C.   DOD'S  PLANNING,  PROGRAMMING ,  BUDGETING  SYSTEM  (PPBS) 

The  Department  of  Defense  (DOD)  utilizes  a  similar  system 
of  planning  and  control  based  on  Anthony's  framework.   The 
system  is  grounded  upon  an  assessment  of  strategic  goals  and 
requirements  and  the  quantification  of  these  requirements  into 
budgetary  vehicles,  following  much  the  same  process  as  des- 
cribed in  Anthony's  management  control  process  presented  in 
Chapter  III.   Summarized,  this  Planning,  Programming,  and 
Budgeting  System  (PPBS)  is  based  on  the  anticipated  threat;  a 
strategy  is  developed  to  counter  the  threat;  requirements  of 
the  strategy  are  then  estimated;  programs  are  developed  to 
package  and  execute  the  strategy;  and  finally,  the  costs  of 
approved  programs  are  budgeted. 
1 .   Planning  and  Programming 

The  concept  of  planning  within  the  DOD  is  meant  to 
fulfill  the  same  role  as  strategic  planning  in  Anthony's 
framework.   Much  as  a  corporate  Board  of  Directors  sets  the 
broad  goals  and  objectives  of  the  corporation,  goals  and 
requirements  of  the  DOD  are  set  by  high  level  bodies,  such  as 
the  Joint  Chiefs  of  Staff,  the  National  Security  Council, 
and  the  Secretary  of  Defense,  which  analyze  the  threat  to  the 
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national  defense  under  varying  scenarios.   These  threat 
analyses  are  viewed  over  long  timeframes  (10  years  or  more) 
considering  numerous  factors  and  are  published  in  the  Joint 
Strategic  Planning  Document  (JSPD) .   From  the  JSPD,  the 
Secretary  of  Defense,  as  the  Chief  Executive  Officer  of  the 
DOD,  issues  his  Defense  Guidance,  which  translates  the  threat 
requirements  into  guidance  for  preparation  of  the  Program 
Objectives  Memoranda  (POM) . 

The  basic  purpose  of  the  programming  phase  of  the 
PPBS  is  to  translate  the  strategy  into  the  program  force 
structures  in  terms  of  time-phased  resource  requirements, 
including  personnel,  funding,  and  material.   Most  of  the 
emphasis  within  the  DOD  and  the  Services  is  devoted  to  develop- 
ment of  the  weapons  systems  determined  as  required  to  meet 
the  threat,  rather  than  analysis  of  the  threat  itself.   Fur- 
ther, as  the  "threat"  or  "strategy"  is  less  than  a  quanti- 
fiable set  of  terms,  and  as  the  threat  is  described  over  a 
long-term  future  basis,  there  is  really  no  firm  method  to 
evaluate  the  developed  threats  in  retrospect.   Hence, 
comparatively  little  emphasis  is  placed  on  the  planning  phase. 
This  has  resulted  in  the  phrase  "Planning,  the  silent  'P1 
in  PPBS." 

The  POM  expresses  the  total  requirements  of  each  of 
the  Services  in  terms  of  force  structure,  manpower,  material 
and  costs,  to  satisfy  all  assigned  functions  and  responsibil- 
ities during  the  period  of  the  Five  Year  Defense  Program  (FYDP) 
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These  requirements  are  expressed  in  terms  of  specific  programs 
within  the  FYDP ,  and  each  of  the  programs  is  assigned  a 
specific  numerical  code,  the  Program  Element  Number  (PEN). 
The  PEN  becomes  a  vehicle  by  which  the  programs  may  be  tracked 
from  the  development  cycle  through  execution. 

Each  of  the  Services  submits  its  POM  to  the  Secretary 
of  Defense  and  the  Joint  Chiefs  of  Staff  for  review  and 
eventual  approval.   The  Secretary's  review/approval  is  in  the 
form  of  Program  Decision  Memoranda  (PDM) ,  which  direct  the 
respective  service  to  make  an  adjustment  to  a  specific  program 
within  its  POM.   The  Service's  POM,  as  adjusted  by  the  various 
PDMs,  becomes  the  guidance  to  the  Service  for  budget 
development. 

2.   Budgeting 

The  ultimate  purpose  of  the  PPBS  is  to  develop  the 
DOD  input  to  the  President's  budget,  which  is  submitted 
annually  to  Congress  in  the  January  timeframe.   The  budgeting 
phase,  however,  is  more  than  a  mere  resubmission  of  the  POM 
as  the  budget  to  Congress  is  in  appropriation  format,  while 
the  POM  was  in  program  format.   This  becomes  a  somewhat 
difficult  task  as  each  program  utilizes  funds  from  various 
appropriations,  such  as  Military  Personnel,  Procurement 
appropriations,  and  Operations  and  Maintenance.   The  PEN, 
previously  described,  becomes  a  key  element  in  crossing 
programs  to  appropriations  and  back. 
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Often  overlooked  in  the  management  control  require- 
ments of  the  DOD  is  the  time-phasing  of  budget  development  and 
budget  execution.   Budget  development,  including  the  planning 
and  programming  phases,  is  being  accomplished  at  the  Service 
headquarters  level  a  year  in  advance  of  the  President's 
budget  submission  to  the  Congress.   Thus,  requirements  for 
FY-85  will  be  submitted  to  the  Congress  in  January,  1984. 
These  requirements  were  developed  over  the  course  of  calendar 
year  1983.   However,  budget  execution  is  performed  at  the 
activity  level,  but  budget  development  emphasis  at  the  activity 
level  is  for  the  next  fiscal  year.   That  is,  in  the  spring 
and  summer  of  1983,  the  activities  are  critically  evaluating 
their  budget  requirements  for  FY-84.   While  most  activities 
are  required  to  identify  needed  resources  for  FY-85  at  the 
same  time,  this  effort  is  less  than  critical  in  the  minds  of 
activity  personnel;  FY-84  is  the  most  important. 

Thus,  while  the  PPBS  has  the  wherewithal  to  be  a 
powerful  management  control  system,  the  sheer  magnitude  of 
the  DOD  and  the  long-term  (2  years  ahead)  budgeting  require- 
ments, a  break  in  the  management  control  system  exists 
between  the  Headquarters  levels  and  the  activity  levels. 
3 .   Budget  Execution 

Resources  are  allocated  to  activities  based  upon 
their  identified  needs,  and  based  upon  the  funding  approp- 
riated by  the  Congress.   At  this  point,  a  further  separation 
of  requirements  occurs,  as  funds  are  passed  along 
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organizational  lines.   Previously  we  witnessed  requirements 
identified  along  program  lines,  converted  to  appropriation 
lines,  and  now  being  segregated  by  activity  lines.   Save  for 
the  program  element  number  (PEN),  tracking,  for  evaluation 
and  control  purposes,  from  requirement  in  the  POM  to  final 
accounting  of  the  funds,  becomes  tantamount  to  impossible. 
It  should  be  noted  that  during  execution,  costs  are  aggregated 
by  organization  and  by  program  in  preparation  for  reports  to 
managers  outside  the  immediate  organization.   There  is 
basically  no  structure  for  maintaining  information  useful  to 
managers  in  the  continuing  operation  of  their  organization. 

Large  commands  do  maintain  an  internal  audit  staff 
to  ensure  resources  have  been  employed  effectively  and 
efficiently  and  within  legal  and  administrative  constraints. 
In  the  past,  there  has  been  little  emphasis  on  preventive 
administrative  and  accounting  controls  which  would  lessen 
the  need  for  the  detective  function  of  internal  audit. 
4 .   Review  and  Evaluation 

As  the  stated  purpose  of  the  PPBS  is  the  submission 
of  the  President's  Budget,  PPBS  does  not  focus  a  great  deal 
of  attention  on  the  area  of  review  and  evaluation.   Activi- 
ties do  attempt  to  avoid  the  hazards  of  RS  3678  and  3679 
violations  and  financial,  compliance,  economy  and  efficiency, 
and  program  audits  are  done  on  a  relatively  regular  basis 
by  all  levels  of  audit  agencies.   However,  the  institution- 
alized coordination  and  control  activities  focus  on  meeting 
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the  requirements  of  outside  managers,  rather  than  the  internal 
needs  of  local  managers;  operational  managers'  performance 
evaluations  focus  primarily  on  the  level  of  attainment,  of 
mission  objectives  rather  than  on  budgetary  performance; 
and  programs  are  reviewed  at  very  high  levels  with  rare 
involvement  of  personnel  at  the  activity  level.   Thus,  the 
review  and  evaluation  processes  at  the  activity  level  are 
more  closely  related  to  operational  or  internal  accounting 
controls  than  to  management  controls. 

D.   CONCLUSION 

Both  the  private  and  public  sector  are  capable  of  estab- 
lishing a  basic  structure  for  the  application  of  management 
control.   However,  in  reality,  the  public  sector's  execution 
is  so  far  removed  from  the  long-range  planning  process  and 
the  span  of  operations  is  so  great  that  overall  control  is 
next  to  impossible  to  attain.   Therefore,  form  has  tended  to 
be  accentuated  over  substance  in  the  public  sector. 
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VI.   CASES 

A.  INTRODUCTION 

Since  an  example  is  worth  a  thousand  words,  a  number  of 
representative  cases  which  illustrate  the  problems  and  risks 
of  accepting  the  narrow  definition  of  internal  accounting 
control  will  be  illustrated  1j  this  chapter.   Some  are  drawn 
from  the  private  sector  and  others  are  from  the  public  sector 
but  managers  in  either  arena  can  relate  the  discussion  to 
their  own  organization. 

B.  PRIVATE  SECTOR 
1.   Wily  Wilby 

This  case  [Ref.  45]  relates  the  story  of  a  man  with 
an  established  history  of  embezzlement  in  Canada  and  the 
United  States.   Each  previous  instance  had  provided  a  learn- 
ing experience  for  him. 

The  main  story  revolves  around  Wilby,  alias  A.  D. 
Hume,  whom  our  man  had  met  by  placing  a  bogus  classified 
advertisement  in  a  trade  journal.   When  the  real  Hume  de- 
parted for  military  duty  during  World  War  II,  Wilby  took 
his  credentials  to  a  New  York  employment  agency  which 
specialized  in  CPA's.   Despite  the  fact  that  the  head  of 
the  agency  knew  the  real  Hume  slightly  and  realized  the  man 
before  him  bore  no  resemblance  to  him  the  embezzler  rose 
above  that  and  was  sent  on  an  interview.   Hume's  impressive 
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credentials  were  verified  and  Wilby  gained  a  new  position 
as  an  accountant  with  the  William  T.  Knott  Company,  a 
management  corporation  for  a  set  of  department  stores  which 
ordered  and  received  their  own  merchandise  and  forwarded  the 
invoices  on  to  the  parent  company  for  payment. 

The  Knott  Company  averaged  $40  million  in  disburse- 
ments per  year  for  which  the  company  felt  it  had  a  foolproof 
accounting  system.   Invoices  were  carefully  compared  with  the 
purchase  orders.   Accountants,  clerks,  typists,  and  standard 
business  machines  took  the  approved  invoices  through  a  lab- 
yrinth bookkeeping  system  at  the  end  of  which  checks  emerged 
ready  for  signature  by  a  check-signing  machine  prior  to  mailing 
This  machine  was  complicated  and  mechanically  above  reproach. 
Only  a  few  personnel  had  access  to  it  and  only  after  the 
proper,  secret  perforations  and  notches  had  been  made  on 
certain  unmentionable  pieces  of  cardboard  —  one  for  each 
invoice  —  would  the  machine  sign  a  vendor's  check.   When  the 
special  machine  was  not  working,  important  pieces  of  it  were 
locked  up  in  different  corners  of  the  same  accounting  office. 

Wilby  progressively  advanced  in  the  company  from 
traveling  accountant  to  home  office  accountant  with  no 
defalcations.   He  was  next  named  chief  accountant  at  $6000 
per  year  and  was  now  in  a  position  to  make  a  fortune. 

During  the  first  year,  Wilby  took  $110,936.81  which 
wasn't  missed  by  the  company  and  was  not  revealed  in  the 
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audit.   During  this  timeframe,  he  was  not  above  taking  a 
personal  interest  in  the  business  machines,  often  dazzling 
the  operators  by  diagnosing  their  machine's  difficulties  after 
a  shrewd  glance  and  some  sympathetic  fingering.   At  the  end 
of  the  year,  he  received  a  $500  bonus  and  was  named  assistant 
treasurer. 

During  the  next  year,  he  took  $275,984.43  and  received 
another  year-end  bonus. 

Wilby  and  his  wife  lived  modestly;  he  saved  some  of 
his  earnings  and  all  he  stole  was  conveniently  available  in 
local  New  York  banks. 

As  chief  accountant,  Wilby  was  tied  to  his  position, 
bringing  office  records  home  each  evening  to  work  on  and  tak- 
ing business  trips  almost  every  weekend. 

At  the  beginning  of  his  third  year  in  the  position, 
Wilby  asked  for  a  short  vacation  to  take  his  wife  skiing  in 
Canada.   Since  the  previous  year's  accounts  balanced  and  all 
was  under  control,  the  request  was  granted. 

When  Wilby  was  due  to  return,  the  Knott  Company 
received  a  telegram  stating  that  the  man  had  broken  his  leg 
and  would  be  detained  —  no  location  was  provided  in  the 
message. 

After  unsuccessful  efforts  to  find  him,  the  company 
realized  its  problem  and  called  in  the  auditors.   They  dis- 
covered that  the  withdrawals  from  the  Knott  account  were 
much  higher  than  the  total  of  the  cancelled  checks  and  that 
a  number  of  the  cancelled  checks  were  missing  as  well. 
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The  embezzler's   scheme  had  been  accomplished  without 
difficulty.   When  the  daily  mail  arrived,  it  was  easy  to 
intercept  several  envelopes,  change  the  value  and  name  on 
the  original  invoices,  add  a  second  invoice  which  duplicated 
the  store's  submission,  and  then  adjust  the  control  totals; 
another  approach  was  to  insert  bogus  invoices  for  his  own 
vendors  and  use  the  secret  pieces  of  cardboard  to  process 
them  through  the  standard  business  machines.   Wilby  had  rented 
office  space  where  the  checks  were  mailed  for  arrival  on  the 
weekend.   On   his  weekend  business  trips,  he  would  make  sure 
to  deposit  them  promptly  in  a  local  bank  for  later  transfer 
to  the  same  bank  branch  that  was  used  by  the  Knott  Company  in 
New  York. 

When  a  Toledo  bank  checked  the  references  of  G.  B. 
Towle,  one  of  the  ficticious  vendors,  "Hume"  assured  it  that 
Towle  was  a  legitimate  businessman  in  the  advertising  line. 

When  D.  True,  an  accountant  at  the  Butte,  Montana 
store,  raised  questions  about  certain  suspicious  freight 
charges  debitted  against  the  store,  the  Knott  Company  treas- 
urer referred  his  inquiry  to  "Hume."   In  his  written  response, 
the  investigators  found  a  clue  as  to  how  the  scheme  had 
worked.   By  tracing  the  freight  charge  through  the  accounting 
system,  they  discovered  how  the  books  balanced  in  spite  of 
the  defalcations.   The  stolen  money  was  charged  to  the  depart- 
ment store  and  deftly  distributed  among  the  stores  in 
different  ways  and  with  shrewd  knowledge  of  which  accounts 
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could  stand  being  raised  a  bit  here  and  there  so  that  the 
stores  wouldn't  notice. 

When  the  auditors  did  their  yearly  review  of  the  books, 
the  embezzler  had  allowed  them  to  add  all  the  bank  statements 
and  the  cancelled  checks,  including  the  ones  he  had  endorsed 
himself,  with  the  result  that  the  withdrawals  from  the  Knott 
Company  bank  account  tallied  with  the  total  of  the  cancelled 
checks.   Then  he  had  destroyed  the  cancelled  checks  he  had 
endorsed  and  had  altered  entries  in  the  books,  so  that,  in 
effect,  what  the  Knott  Company  had  lost  to  him  it  got  back 
from  the  stores,  in  the  form  of  debits  against  the  stores' 
accounts.   The  investigators  wondered  why  Wilby  had  departed 
so  suddenly  since  if  he  had  followed  through  for  the  current 
year,  he  would  probably  never  have  been  discovered. 

As  a  protective  procedure,  companies  bond  their 
employees.   Because  the  insurance  company  which  had  bonded 
Wilby  had  a  large  investment  in  the  case,  he  was  pursued 
diligently. 

It  was  easy  enough  to  find  the  real  Major  Hume  and 
realize  he  did  not  meet  the  description  of  the  embezzler. 

Old  bank  records  revealed  one  of  the  few  careless 
mistakes  of  the  imposter.  When  he  had  purchased  a  bank  draft, 
Wilby  had  originally  requested  that  it  be  made  out  to  his 
real  name .   Then  he  had  changed  his  mind  and  named  Hume  as 
the  payee.   This  was  all  the  police  needed  to  trace  Wilby 's 
record  and  photographs. 
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After  finally  apprehending  Wilby,  the  Knott  Company 
was  satisfied  the  embezzler  had  no  human  accomplices  but  the 
standard  business  machines  were  criticized  and  newly  devised 
safeguards  were  added  to  them. 

The  Federal  Bureau  of  Investigation  (FBI)  proved  to 
be  the  reason  why  Wilby  had  left  the  firm  so  abruptly.   At 
the  time  this  case  was  occurring,  the  mid-1940 's,  the  FBI 
was  investigating  German  names,  specifically  one  F.  B.  Hecht, 
who  the  agency  was  convinced  was  a  Nazi  Fifth  Columnist. 
Hecht  had  been  one  of  Wilby 's  ficticious  vendors  and  the 
local  St.  Louis  bank  provided  "Hume's"  name  as  a  reference 
to  the  agency.   He  provided  them  misleading  information  but 
the  agency  continued  to  pursue  the  issue  so  Wilby  did  not 
wait  for  the  approaching  showdown. 

Although  currently  considered  a  statutory  felony, 
at  the  time  of  the  Wilby  case,  embezzlement  was  not  generally 
considered  a  crime  against  the  people  and  perpetrators  were 
often  given  suspended  sentences  or  short  prison  terms  if  they 
made  restitution. 

However,  the  judge  in  this  case  felt  that  if  Wilby 
was  given  a  lenient  sentence,  he  would  be  foolish  if  he 
didn't  continue  to  embezzle.   So  the  judge  sentenced  him  to 
from  five  to  seven  years  in  Sing  Sing  and  requested  his 
deportation  at  the  completion  of  the  prison  term. 

So  much  for  the  W.  T.  Knott  Company's  foolproof 
system!   A  review  of  the  factors  that  shaped  the  internal 
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accounting  control  environment  shows  just  how  easy  they  were 
to  circumvent  in  this  particular  situation. 

Wilby  understood  the  processes  of  the  accounting 
system,  the  duties  of  its  personnel,  and  the  intricacies  of 
the  standard  business  machines  so  well  that  he  was  able  to 
effectively  manipulate  all  the  peripheral  clerical  and 
administrative  procedures  surrounding  it.   Even  though  the 
books  were  in  perfect  balance  when  audited  (reliable  finan- 
cial records)  and  the  company  did  not  notice  any  missing 
funds  (safeguarded  assets) ,  the  true  picture  indicated  that 
there  was  little  operational  effectiveness  or  efficiency 
or  little  adherence  to  managerial  policies  (internal  adminis- 
trative controls) .   And  so  in  the  final  analysis  the  account- 
ing controls  were  inoperative  as  well. 

A  more  thorough  investigation  of  Wilby 's  credentials 
should  have  been  completed  by  the  employment  agency  especially 
since  the  director  knew  he  was  not  dealing  with  the  real 
Hume. 

The  Knott  Company  was  disarmed  by  the  apparent  out- 
standing performance  and  charming  personality  of  their  wily 
employee.   The  firm  should  have  been  a  bit  more  aware  of  the 
internal  control  mechanism  of  separation  of  duties;  rather 
than  relying  on  the  convenience  of  an  in-house  repairman, 
vice  the  expense  it  should  have  employed  a  disinterested 
serviceman. 
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Wilby  was  able  to  rise  smoothly  above  the  few  ques- 
tions that  were  raised.   As  stated  in  the  original  case 
"...  such  strange  things  have  happened  that  we  cannot  count 
on  anything." 

This  case  demonstrates  the  value  of  personnel  who 
raise  critical  questions.   It  is  a  matter  of  judgment  whether 
to  pursue  such  information  but  the  Knott  Company  could  have 
benefitted  if  it  had  not  placed  such  faith  in  its  employee. 
2.   Rockwell  International  Corporation 

Rockwell  expected  to  save  a  lot  of  money  by  leasing 
computers  from  third  parties  rather  than  buying  or  renting 
them  from  manufacturers. 

Instead  the  company  became  a  victim  in  the  computer- 
leasing  fraud  carried  out  by  OPM  Leasing  Services,  Inc. 

A  recent  court-ordered  investigation  has  revealed 
that  poor  financial  and  management  controls  made  the  company 
an  easy  mark. 

The  practices  which  facilitated  the  fraud  included 

the  following: 

Rockwell's  lawyer  in  charge  of  computer  leasing 
allowed  his  secretary  to  keep  a  stack  of  pre-signed 
legal  opinions  that  sometimes  were  attached  to  un- 
read leases  ...  Rockwell  officials  also  didn't 
attend  lease  closings  and  thus  wouldn't  be  able  to 
notice  when  documents  had  been  doctored  or  switched. 

Bad  record-keeping  hurt  the  company  too.   Officials 
often  didn't  keep  track  of  lease  documents,  make 
copies,  or  note  when  papers  were  missing.   Thus 
Rockwell  had  no  way  to  determine  whether  computers 
listed  on  a  particular  lease  presented  by  OPM  for 
execution  had  already  appeared  on  a  prior  lease 
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which  happened  in  some  cases.  That  allowed  the 
swindlers  to  fraudulently  secure  bank  loans  for 
equipment  never  bought  or  delivered  to  Rockwell. 

Leases  often  specified  payments  were  to  be  sent 
directly  to  the  banks  that  had  financed  the  computers. 
Instead,  Rockwell  often  paid  OPM  with  the  belief  the 
money  would  be  forwarded  to  the  bank.   0PM,  however, 
frequently  missed  the  payments.   Disregarding  direct 
payment  obligations  facilitated  the  fraud  and  dero- 
gated the  legal  rights  of  the  financing  institutions. 

—  Rockwell  apparently  suspected  that  management  of  its 
computer  leasing  wasn't  as  tight  as  it  could  be. 
Internal  audits  in  1979  and  1980  concluded  too  much 
responsibility  was  concentrated  in  the  hands  of  the 
director  of  computer  planning  and  his  role  was  re- 
duced but  he  continued  to  help  OPM  land  most  of  the 
computer  leasing  contracts  despite  Rockwell's  growing 
reservations  about  OPM's  honesty  and  financial 
soundness . 

Rockwell's  chief  financial  officer  ordered  an  examina- 
tion of  OPM's  financial  statements  to  determine  the 
company's  soundness.   Mr.  Goodman  of  OPM  gave  Rockwell's 
treasurer  a  bogus  financial  statement.   He  testified 
that  Rockwell's  director  of  computer  planning  had  told 
him  not  to  worry  about  the  financial  review  since  the 
treasurer  '  ...  doesn't  understand  financial  state- 
ments anyway,  so  you  can  double  talk  your  way  around 
it.   And  you  should  have  no  problem. '   This  was  an 
accurate  prediction  since  the  treasurer  did  not 
notice  the  absence  of  a  date  on  the  auditor's  report 
or  the  inadvertent  inclusion  of  cash  and  marketable 
securities  in  the  receivables  subtotal.   He  focused  on 
net  worth,  finding  the  grossly  inflated  $44.9  million 
figure  satisfactory. 

—  Rockwell  officials  learned  in  1980  that  the  OPM 
swindlers  had  pleaded  guilty  to  check  kiting  charges 
in  a  separate  matter  but  the  company  continued  to 
conduct  business  with  OPM  until  1981. 

Rockwell  has  denied  that  its  management,  record- 
keeping or  financial  controls  contributed  significantly  to 
the  fraud  but  the  company  has  agreed  to  adopt  new  leasing 
rules  requiring:   top  officials  to  approve  all  third-party 
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leases;  the  company  to  keep  lease  documents  and  copies  in 
a  central  filing  system  and  make  lease  payments  only  to  the 
people  who  are  supposed  to  be  paid;  company  lawyers  give  an 
opinion  about  proposed  lease  contracts  and  be  present  when 
they  are  signed.  [Ref.  46] 

It  is  clear  that  failure  to  follow  established  poli- 
cies and  guidelines,  inattention  to  detail  and  ineffective 
management  oversight  greatly  contributed  to  this  fraud.   Such 
concerns  are  related  to  internal  administrative  controls  but 
have  the  potential  to  generate  large  financial  losses. 

Better  management  controls  in  the  following  areas 
could  have  prevented  this  fiasco:   a  more  careful  selection 
of  qualified  and  trustworthy  personnel,  more  formal  legal 
procedures,  more  rigid  recordkeeping,  and  tighter  financial 
administrative  controls. 

The  narrow  range  of  internal  accounting  controls 
fails  to  recognize  the  importance  of  such  concerns  as  adher- 
ence to  management  policies  or  operational  effectiveness  or 
efficiency.   This  case  illustrates  the  tremendous  losses, 
estimated  at  $600  million  which  can  be  suffered  by  a  company 
which  fails  to  focus  enough  attention  on  the  enforcement  of 
internal  administrative  controls. 
3.   General  Dynamics 

A  federal  grand  jury  indicted  two  former  General 
Dynamics  executives  for  receiving  kickbacks  in  connection 
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with  construction  of  liquified  natural  gas  (LNG)  tankers  and 
Navy  nuclear  submarines.   The  two  named  in  the  indictment 
were  P.  Takis  Veliotis  and  James  H.  Gilliland. 

The  indictment  states  the  kickbacks  were  arranged 
through  Frigitemp  Corporation,  a  General  Dynamics  subcontractor 
which  provided  interior  fixtures  and  insulation  for  ships. 
Frigitemp  was  declared  bankrupt  in  1979  but  its  subcontracts 
were  transferred  to  another  company  so  the  scheme  could 
continue.   A  vice  president  and  the  chairman  and  chief  execu- 
tive officer  of  the  subcontractor  were  also  indicted  for 
arranging  and  making  the  kickback  payments. 

The  kickback  scheme  began  in  1973  and  1974  when 
Frigitemp  realized  that  kickbacks  to  Veliotis  and  Gilliland 
would  ensure  winning  the  subcontracts.   As  ten  of  the  LNG 
tankers  were  built,  Frigitemp  received  more  than  $44  million 
in  subcontracts.   The  awards  were  made:   in  one  instance  even 
though  the  shipyard's  purchasing  department  had  recommended 
a  previous  bidder;  in  another  instance,  even  though  the  time 
specified  for  the  receipt  of  bids  hadn't  expired. 

Funds  for  the  scheme  were  generated  by  having  Frigi- 
temp pay  for  non-existent  consulting  services  and  raw 
materials.   These  costs  were  passed  on  to  the  prime  contractor 
who  in  turn  passed  some  of  them  on  to  the  federal  government. 

When  subcontracts  were  awarded  to  Frigitemp  for  two 
of  the  tankers,  shipyard  employees  protested  that  the  bids 
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submitted  by  the  subcontractor  were  far  in  excess  of  competing 
bids.  [Ref.  47] 

Despite  the  facts  that:   adequate  procedures  were 
established  in  the  area  of  contract  administration;  shipyard 
employees  protested  the  awards,  and  the  Navy  questioned  cost 
overruns,  management  was  able  to  render  the  controls 
ineffective.   This  case  illustrates  the  limitations  of  inter- 
nal controls  when  management  colludes  and  overrides  them. 
It  also  shows  the  value  of  fostering  a  critical  attitude 
among  employees  so  that  they  may  bring  concerns  to  management's 
attention. 

4.   Touche  Ross 

A  Wall  Street  Journal  article  [Ref.  48]  states  that 
the  SEC  recently  charged  one  of  the  "Big  Eight"  auditing 
firms  with  failure  to  examine  the  company's  financial  state- 
ment in  accordance  with  generally  accepted  auditing  standards. 

The  surface  shipyard  signed  contracts  worth  $3 
billion  to  build  destroyers  and  helicopter  carriers  for  the 
Navy.   For  several  reasons,  including  blunders  in  production, 
the  contractor's  expenses  began  ballooning.   Rather  than 
recording  the  burgeoning  expenses  as  losses  when  incurred, 
the  company  deferred  them  in  the  hopes  that  the  Navy  would 
pay  the  extra  bills. 

The  SEC  said  that  the  auditing  firm  should  not  have 
acquiesced  to  the  contractor's  deferral  of  the  losses. 
Although  the  auditor  had  issued  qualified  opinions  subject 
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to  uncertainties  over  the  dispute,  the  SEC  stated  that  the 
auditing  firm  should  have  known  that  the  contractor  was 
unlikely  to  escape  without  losses  and  therefore,  should  have 
recommended  that  the  company  recognize  at  least  some  of  the 
losses  earlier.   Further,  the  SEC  felt  that  the  auditor  should 
have  challenged  management  about  the  contract  losses. 

The  contract  dispute  ended  in  1973  with  the  company 
accepting  a  $200  million  loss  on  Navy  work. 

Although  this  article  primarily  addresses  the  fair- 
ness of  the  presentation  of  financial  statements  and  thus 
is  closely  tied  to  internal  accounting  controls,  it  also 
indicates  that  management's  failure  to  deal  with  problems 
in  program  or  operational  areas  can  quickly  be  translated 
into  financial  ones.  Even  if  controls  as  established  are 
adequate,  failure  to  follow  them  negates  their  value. 

This  particular  case  also  raises  concerns  about 
the  apparent  willingness  of  audit  firms  to  accept  manage- 
ment's views  without  maintaining  a  healthy  skepticism  or 
exercising  the  professional  judgment  gained  through  numerous 
audits. 

5.   Itel 

Another  Wall  Street  Journal  article  [Ref .  49]  dis- 
cusses a  court-ordered  examiner's  report  that  asserted  Itel's 
collapse  was  caused  by  decisions  of  top  management  and  the 
failure  to  act  by  the  company's  outside  lawyers,  auditors, 
and  directors. 
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'There  was  substantial  failures  by  the  company's 
management  and  legal  counsel  to  make  full  disclosures  of 
significant  facts  and  developments1  and  the  auditing  firm 
'breached  its  contractural  duties  to  perform  an  adequate 
audit'  and  to  inform  the  company's  directors  of  the  serious- 
ness of  its  weaknesses  of  internal  controls. 

The  central  cause  of  these  breaches  was  the  dominant 
management  style  of  the  company's  president  who  believed  that 
controls  would  'stifle  entrepreneurship'  and  threaten  the 
'ambience'  of  the  company. 

As  a  result,  the  company's  management  style  and 
attitudes,  weak  internal  controls,  major  business  problems, 
and  heavy  debt  combined  to  force  the  corporation's  financial 
collapse  in  1979. 

The  report  said  that  its  'criticism  of  outside 
directors  related  not  to  improper  actions  but  to  their  lack 
of  actions.   They  did  not  conduct  the  kind  of  oversight 
function  one  might  have  expected.' 

Finally,  the  report  stated  that  the  1978  and  1979 
financial  statements  'contained  materially  false  and  mis- 
leading information.' 

This  case  illustrates  what  can  happen  when  manage- 
ment control  and  internal  accounting  and  administrative 
controls  are  not  enforced  or  are  nonexistent. 

The  last  two  cases  dealing  with  the  private  sector 

are  extracted  from  Professor  San  Miguel's  forthcoming 

book.  {Ref.  50] 
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6 .   Penn  Central  Transportation  Company  (PCTC) 

One  of  the  largest  mergers  in  industrial  history  (in 
terms  of  assets)  was  the  marriage  of  the  Pennsylvania  Railroad 
and  the  New  York  Central  Railroad  in  1968.   Two  years  later, 
the  combined  entity  became  one  of  the  largest  bankrupt 
organizations  in  history.   Some  of  the  reasons  listed  for  the 
collapse  include  a  lack  of  flow  forecasts,  lack  of  a  costing 
system,  creative  accounting,  lack  of  budgetary  control,  and 
improper  asset  valuation.   More  specifically,  management 
incorrectly  charged  operating  expenses  to  capital,  allowed 
the  crediting  of  uncollectibles  to  income,  recognized  gains 
on  the  transfer  of  assets  from  one  subsidiary  to  another,  and 
made  loans  to  subsidiaries  and  then  recorded  the  cash  flow- 
ing back  to  the  parent  company  as  dividends.   One  analyst 
commented  that  these  practices  turned  a  $95  million  actual 
loss  in  1969  into  a  reported  profit  before  extraordinary 
items  of  $4.4  million.   Such  practices  are  intentional  per- 
petrations by  management  and  it  is  doubtful  that  any  internal 
control  system  could  have  prevented  them. 

However,  other  unintentional  deficiencies  in  internal 
control  appear  to  have  contributed  to  the  collapse.   Evidently, 
PCTC  operated  filthy  trains  on  rails  in  serious  disrepair. 
Service  was  very  poor  with  trains  often  missing  scheduled 
arrivals.   Apparently,  an  employee  and  management  performance 
evaluation  system  was  not  in  place  to  prevent  such  poor 
business  practices  and  supervision.   These  matters  related 
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to  operational  efficiency  and  managerial  policies,  administra- 
tive concerns  overlooked  by  the  narrow  definition  of  internal 
control.   In  addition  to  lack  of  management  communication 
flowing  down  into  the  organization,  an  inadequate  management 
information  system  prevented  proper  information  from  flowing 
up  to  management.   Just  prior  to  collapse,  the  Department  of 
Transportation  requested  a  cash  flow  forecast  in  response 
to  the  company's  bail-out  request  to  the  federal  government. 
However,  no  such  forecast  was  forthcoming  due  to  the  inadequate 
records.   Ironically,  17  members  of  the  board  of  directors 
were  bankers.   On  June  21,  1968,  PCTC  ran  out  of  cash  and 
filed  for  bankruptcy. 

Although  internal  controls  might  not  have  prevented 
management's  manipulation  of  accounting  policies,  they  might 
well  have  prevented  cash  insolvency.   Preparation  of  a  state- 
ment of  sources  and  uses  of  cash  for  1962-67  would  have 
shown: 

SOURCES  AND  USES  OF  CASH 
(in  million  $) 

Sources: 

Rail  Income  $  38  0 

Non  Rail  Income         3  50 


730 

Uses : 

Interest 

200 

Dividends 

450 

Capital  Expenditures 

1200 

1850 

Decrease  in  Cash 

$1120 
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It  appears  that  periodic  preparation  and  review  of 
cash  flow  forecasts  would  have  highlighted  the  significant 
cash  outflow  and  future  cash  shortage.   Also,  it  would  appear 
that  the  board  of  directors  did  not  inquire  into  the  cash 
flow  situation  until  it  was  too  late.   Since  such  information 
plays  a  vital  role  in  the  safeguarding  of  assets  (especially 
cash) ,  it  qualifies  as  an  element  of  internal  accounting 
control.   In  the  case  of  PCTC ,  this  element  was  seriously 
lacking. 

7.   W.  T.  Grant 

Unlike  the  bankruptcy  of  Penn  Central,  the  public 
was  not  surprised  by  the  failure  of  W.  T.  Grant.   The  finan- 
cial papers  regularly  printed  stories  concerning  this 
retailer's  financial  woes  during  the  year  prior  to  bankruptcy 
The  1973-74  recession  served  to  accelerate  the  company's 
decline  and  brought  about  its  financial  death  in  1975. 

Analysts  have  cited  these  reasons  for  failure:   an 
overly  aggressive  expansion  program  (612  new  stores  between 
1963  and  1973) ,  lack  of  uniformity  among  stores,  lack  of 
management  skill  and  merchandising  focus,  excess  inventory 
due  to  a  wide  product  line,  and  a  switch  to  a  cash  draining 
revolving  customer  credit  program.   To  fund  the  expansion 
program,  management  raised  debt  inflating  the  company's 
debt/equity  ratio  to  .7  in  1972  Cone  of  the  highest  ratios 
of  any  major  merchandiser) .   Additionally,  the  company  paid 
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out  dividends  on  common  stock  in  fiscal  1973  and  1974  equal 
to  128%  of  the  earnings  available  to  common  stockholders. 
The  high  interest  rates  and  credit  crunch  of  1974,  combined 
with  the  cash  strains  inflicted  by  management,  were  suf- 
ficient to  squeeze  the  last  drops  of  liquidity  out  of  the 
company.   Other  signs  of  failure  existed  long  before  the 
insolvency.   Sales  per  square  foot  ranged  between  $32  and 
$35,  less  than  half  of  the  rates  obtained  by  Grant's 
competitors.   Poor  store  site  locations  were  cited  as  a 
contributing  factor  to  the  sales  volume  falling  below  those 
of  competitors.   Between  1968  and  1972  Grant's  sales  increased 
50%  because  of  the  numerous  new  stores  opened  but  earnings 
remained  flat. 

The  Grant's  failure  does  not  appear  to  be  primarily 
due  to  weak  internal  accounting  controls  (as  narrowly  defined) 
but  to  weak  administrative  controls.   A  close  monitoring  and 
forecasting  of  cash  flow  and  policies  to  retain  cash  would 
have  helped  maintain  Grant's  liquidity.   Consistent  with 
steps  to  protect  liquidity,  slower  growth  and  efforts  to 
increase  the  profitability  of  existing  stores.   Such  considera- 
tions are  not  encompassed  by  the  narrow  definition  of  inter- 
nal control  yet  are  basic  to  the  interests  of  investors, 
creditors,  and  employees,  suppliers,  and  others  who  must 
suffer  the  consequences  from  such  a  significant  bankruptcy. 
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Although  the  W.  T.  Grant's  litigation  is  not  yet 
completed,  serious  questions  have  been  raised  concerning  the 
adequacy  of  controls  over  accounts  receivables  and  inventories 
When  compared  to  the  control  systems  used  by  other  large 
retailers,  the  internal  controls  for  Grant's  receivables  and 
inventories  were  deficient.   Also,  the  company  had  a  very 
small  internal  audit  staff.   These  allegations  of  inadequate 
internal  controls  are  more  related  to  the  narrow  concept  of 
internal  accounting  control. 

C.   PUBLIC  SECTOR 

1.  Introduction 

The  Defense  Audit  Service  has  provided  examples  of 
adverse  conditions  due  to  weaknesses  in  internal  control. 
This  sample  of  cases  will  focus  on  administrative  controls 
primarily  but  will  mention  some  illustrations  which  deal  with 
accounting  controls  as  well.   This  approach  is  used  to  show 
that  within  an  organization  the  controls  which  encourage 
operational  effectiveness  and  efficiency  and  the  adherence 
to  managerial  policies  and  procedures  provide  a  framework 
within  which  to  integrate  internal  accounting  controls. 

2.  Separation  of  Duties 

The  lack  of  separation  of  duties  resulted  in  the 
embezzlement  of  almost  $2  million  over  a  3-year  period  from 
the  DOD  Civilian  Health  and  Medical  Program  of  the  Uniformed 
Services  (CHAMPUS) .   The  program  pays  non-Government 
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hospitals  and  doctors  for  the  medical  care  of  eligible 
military  personnel  and  their  dependents.   Because  of  poor 
internal  controls,  a  civilian  program  administrator  was 
allegedly  able  to  embezzle  funds  by  preparing  and  certifying 
over  3,300  phony  medical  claims.   The  administrator  was 
responsible  for  processing  and  approving  all  claims  received 
under  this  program. 

3 .  Physical  Security 

Imprest  funds  were  often  exposed  to  the  risk  of  loss, 
theft  or  misuse  because  not  all  agencies  were  adequately 
controlling,  safeguarding  or  managing  millions  of  dollars  in 
such  funds.   One  fiscal  office  that  was  not  following  GAO 
and  Treasury  requirements  to  safeguard  funds  lost  about 
$209,000.   The  office  kept  its  imprest  funds  in  an  unlocked 
cashbox  stored  in  a  safe  which  was  accessible  to  several 
people  other  than  the  cashier. 

4 .  Segregation  of  Duties  Involving  Government  Transporta- 
tion Requests  (GTRs) 

In  many  locations  GTRs  were  susceptible  to  conversion 

for  personal  use  because  of  inadequate  safeguards  and 

controls.   These  documents  are  issued  to  Federal  employees 

to  be  used  in  place  of  cash  to  pay  for  travel  on  official 

business.   Over  a  2-year  period,  an  employee  at  one  location 

converted  several  GTRs,  amounting  to  more  than  $30,000,  for 

personal  use.   He  was  able  to  do  this  because  he  had  total 

control  over  acquiring,  maintaining,  issuing  and  accounting 

for  these  easily  convertible  documents. 
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5 .  Payroll  Control 

Payroll  preparation,  processing,  distribution  and 
related  activities  are  common  areas  of  fraud,  waste  and  abuse 
False  statements  on  time  and  attendance  documents  are  a 
most  frequent  problem.   In  one  case,  a  Government  employee 
was  responsible  for  maintaining  time  and  leave  records  and 
sending  the  information  to  the  agency's  central  payroll 
office.   The  individual  added  fraudulent  overtime  hours  to 
her  own  payroll  data  before  sending  it  to  the  payroll  office. 
This  same  individual  distributed  the  payroll  checks.   The 
fraud  was  detected  because  the  timekeeper  was  absent  on  a 
day  when  the  payroll  checks  were  received  for  distribution. 
Her  supervisor  distributed  the  checks  and  noticed  the  time- 
keeper was  receiving  excess  pay.   The  individual  received 
$3,200  in  fraudulent  overpayments  before  being  caught. 

6 .  Personnel  Control 

False  statements  on  employment  applications  are  the 
most  frequently  encountered  problem.   For  example,  several 
DOD  cases  involved  the  fraudulent  enlistment  of  illegal 
aliens  into  a  military  service.   The  aliens  enlisted  by 
presenting  false  birth  certificates  or  other  false  proof 
of  U.S.  citizenship.   In  another  case,  a  recruiter,  under 
pressure  to  fill  his  quota  of  enlistments,  allegedly  en- 
couraged a  recruit  not  to  disclose  his  police  record. 
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7 .  Control  of  Foreign  Military  Sales 

Unfunded  civilian  personnel  retirement  costs  were 
not  billed  to  FMS  overhaul  and  repair  cases  because  the  repair 
facilities  performing  the  overhaul  were  not  including  a  charge 
for  unfunded  civilian  retirement.   This  situation  occurred 
because  implementing  instructions  had  not  been  issued  to 
repair  facilities  requiring  the  inclusion  of  13.4  percent 
for  unfunded  civilian  retirement  costs.   At  least  $566,000 
was  not  charged  to  FMS  customers  during  FY  1979  for  unfunded 
civilian  retirement. 

8 .  Control  of  Support  Services 

Office  furniture  was  not  accounted  for  and  was  subject 
to  theft  or  misuse.   Records  were  not  maintained  to  identify 
the  quantity  or  the  condition  of  furniture  turned  in  for 
storage.   Documentation  was  not  available  to  support  furniture 
disposals.   After  furniture  was  issued  from  the  stock  fund, 
no  further  accountability  was  maintained. 

9 .  Adequate  Documents  and  Records 

A  naval  air  station  found  that  a  SERVMART  was  not 
returning  a  copy  of  the  SERVMART  Shopping  List  (NAVSUP  Form 
1314)  to  the  ordering  unit/command,  setting  up  the  possibility 
of  the  ordering  of  unauthorized/unnecessary  items/quantities 
of  material. 

10.   Authorization  Procedures 

A  naval  air  station  found  a  lack  of  internal  control 
over  the  receipt,  issue,  and  recording  of  small  arms 
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ammunition  being  passed  from  ordnance  personnel  to  activity 
units.   73,000  rounds  were  determined  to  have  been  issued  to 
personnel  who  were  either  not  authorized  to  requisition  the 
ammunition,  or  not  authorized  to  receipt  for  or  pick  up 
ammunition.   Also  there  was  no  separation  of  duties  for 
receipt,  issue,  and  record  maintenance  functions  performed 
by  ordnance  personnel. 

D.   CONCLUSION 

In  assessing  these  cases  which  span  approximately  forty 
years,  consideration  should  be  given  to  what  has  been 
learned. 

In  the  1940 's,  Wily  Wilby  effectively  manipulated  the 
"foolproof"  accounting  system  of  the  Knott  Company  because 
of  the  company's  lax  administrative  and  clerical  procedures. 

Despite  the  fact  that  business  firms  and  governmental 
agencies  have  institutionalized  the  audit  function,  both 
internal  and  external,  and  recently  passed  legislation  has 
attempted  to  ensure  the  establishment  of  adequate  systems 
of  internal  accounting  control  in  both  the  private  and  public 
sectors,  current  examples  indicate  that  such  a  narrow  em- 
phasis does  not  ensure  a  well-managed  (controlled)  business 
or  necessarily  lead  to  attaining  the  goals  of  safeguarded 
assets  and  reliable  accurate  accounting  records. 

Management  should  focus,  instead,  on  the  intertwined 
administrative  and  accounting  controls  which  together  lead 
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to  effectively  and  efficiently  attaining  program  and  opera- 
tional objectives,  as  well  as  financial  and  administrative 
ones . 

Yet,  the  picture  presented  is  not  quite  so  bleak.   A 
final  private  sector  case  is  presented  illustrating  a 
recognized  system  of  internal  control.   It  should  be  kept 
in  mind  that  this  example  focuses  on  the  commercial  sector's 
performance  measures  of  profit  and  loss  and  that  each 
organization  is  unique  and  its  internal  controls  must  be 
adapted  to  that  situation.   Even  so,  much  can  be  learned 
from  this  presentation. 

1 .   International  Telephone  and  Telegraph  Corporation  (ITT) 

This  discussion  will  center  on  the  sections  of  a  case 
[Ref.  51]  which  deals  with  the  establishment  and  operation  of 
ITT ' s  Business  Plan.   The  reader  should  keep  in  mind  DOD ' s 
PPBS  budget  process  as  well  as  Anthony's  Management  Control 
framework  as  he  or  she  proceeds . 

ITT  attributes  much  of  its  success  to  an  extensive 
system  of  financial  reports  it  uses  to  control  its  operating 
units.   The  system  measures  progress  in  the  conventional 
sense  of  sales,  earnings  and  return  on  investment  and  forces 
operating  personnel  to  focus  their  attention  on  critical 
areas  and  to  think  beyond  the  problems  at  hand  to  longer 
range  objectives  and  strategy. 

The  annual  Business  Plan,  the  primary  document  of 
the  reporting  and  control  system  is  extremely  comprehensive. 
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It  is  used  as  the  primary  standard  for  evaluating  the  perform- 
ance of  unit  managers. 

Each  January,  the  regional  headquarters  sets  tentative 
objectives  for  the  following  two  years  for  each  of  its  operat- 
ing units.   This  'first  look'  is  an  attempt  to  provide  a 
broad  statement  of  objectives  permitting  the  operating  units 
to  develop  their  own  detailed  Business  Plans.   Objectives  are 
established  for  both  the  unit  as  a  whole  and  for  each  sep- 
arate product  line. 

For  each  of  the  many  product  lines,  objectives  are 

established  for  five  key  measures: 

Sales 

Net  Income 

Total  Assets 

Total  Employees 

Capital  Expenditures 

From  January  to  April,  these  tentative  objectives 
are  'negotiated'  between  the  regional  headquarters  and  the 
operating  managers. 

During  May,  the  negotiated  objectives  are  reviewed 
and  approved  by  the  regional  and  corporate  headquarters. 
These  final  reviews  focus  primarily  on  the  five  key  measures 
noted  above. 

In  June  and  July,  the  unit  prepares  its  Business 
Plan,  describing  in  detail  how  the  subsidiary  intends  to 
achieve  its  approved  objectives  for  the  following  two  years. 

The  Business  Plan  is  broad  in  scope,  beginning  with 

a  brief  one-page  financial  and  operating  summary  comparing 

data  for: 
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Preceding  year  (actual  date) 
Current  year  (budget) 
Next  year  (forecast) 
Two  years  hence  (forecast) 
Five  years  hence  (forecast) 

This  summary  contains  information  dealing  with  the 

following  measures  for  each  of  the  five  years: 

Net  Income 
Sales 

Total  assets 

Total  capital  employed  (sum  of  long-term  debt  and 
net  worth) 

Receivables 

Inventories 

Plant,  property  and  equipment 

Capital  expenditures 

Provision  for  depreciation 

%  return  on  sales 

%  return  on  total  assets 

%  return  on  total  capital  employed 

%  total  asset  to  sales 

%  receivables  to  sales 

%  inventories  to  sales 

Orders  received 
Orders  on  hand 

Average  number  of  full-time  employees 

Total  cost  of  employee  compensation 

Sales  per  employee 

Net  income  per  employee 

Sales  per  $1000  of  employee  compensation 

Net  income  per  $10  00  of  employee  compensation 

Sales  per  thousand  square  feet  of  floor  space 

Net  income  per  thousand  square  feet  of  floor  space 

Expected  changes  in  net  income  for  the  current  year 

and  for  each  of  the  next  two  years  are  summarized  according 

to  their  cause. 
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This  analysis  forces  operating  managers  to  appraise  the  profit 
implications  of  all  management  actions  affecting  prices, 
costs,  volume  or  product  mix  carefully. 

These  condensed  reports  are  followed  by  a  complete 
set  of  projected  financial  statements  for  the  current  year 
and  for  each  of  the  next  two  years,  with  supporting  detail 
provided  for  major  items  on  the  statements. 

The  Business  Plan  contains  a  description  of  the 
major  management  actions  planned  for  the  next  two  years  with 
an  estimate  of  the  favorable  or  unfavorable  effect  of  each 
one  in  monetary  terms. 

Separate  plans  are  presented  for  each  of  the  func- 
tional areas:   marketing,  manufacturing,  research  and 
development,  financial  control,  and  personnel  and  employee 
relations.   These  plans  state  the  function's  mission,  an 
analysis  of  its  present  problems  and  opportunities,  and  a 
list  of  specific  actions  projected  for  the  next  two  years. 

The  Business  Plan  closes  with  a  series  of  compara- 
tive financial  statements  which  depict  the  item-by-item 
effect  if  sales  fall  to  60%  or  to  80%  of  forecast  or  increase 
to  120%  of  forecast.   For  each  of  these  levels  of  possible 
sales,  costs  are  divided  into  three  categories:   fixed  costs, 
unavoidable  variable  costs,  and  management  discretionary 
costs.   Management  describes  the  specific  actions  it  will 
take  to  control  employment,  total  assets,  and  capital 
expenditures  in  case  of  a  reduction  in  sales  and  also 
indicates  when  these  actions  would  be  put  into  effect. 
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By  mid-summer  the  completed  Business  Plan  is  sub- 
mitted to  company  headquarters  and  in  the  early  fall  meetings 
are  held  at  the  regional  headquarters  to  review  each  unit's 
Business  Plan.   At  these  sessions,  top  management  often 
proposes  changes  before  final  approval  of  a  unit's  individual 
plan. 

The  approved  plan  forms  the  foundation  of  the  follow- 
ing year's  budget.   The  budget's  general  design  follows  the 
Business  Plan's  format  except  that  the  various  dollar  amounts 
are  broken  down  by  months. 

Every  unit  submits  standard  periodic  reports  to  the 
regional  headquarters  on  a  fixed  schedule.   Then  computer 
processing  facilitates  combining  the  results  regionally  and 
for  the  entire  corporation. 

The  main  focus  in  the  reports  is  on  the  variance 
between  actual  results  and  budgeted  results.   Data  are  pre- 
sented for  both  the  latest  month  and  for  the  year  to  date. 
Differences  between  the  current  year  and  the  prior  year  are 
also  reported. 

Thirteen  different  reports  are  submitted  by  the  unit 

Controller  on  a  monthly  basis  including: 

Statement  of  preliminary  net  income  (within  the  first 

week  after  close) 
Statement  of  income 
Balance  sheet 

Statement  of  changes  in  retained  earnings 
Statement  of  cash  flow 
Employment  statistics 
Status  of  orders  received,  cancelled  and  outstanding 
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Statement  of  intercompany  transactions 
Statement  of  transactions  with  headquarters 
Analysis  of  inventories 
Analysisis  of  receivables 

Status  of  capital  projects  (due  last  day  of  each  month) 
Controller's  monthly  operating  and  financial  review 
(20  or  more  pages) 

The  final  item  contains  an  explanation  of  the  signif- 
icant variances  from  budget,  as  well  as  a  general  commentary 
on  the  financial  affairs  of  the  unit. 

In  addition,  twelve  other  reports  are  required,  either 
quarterly,  semi-annually,  or  annually. 

A  unit's  periodic  financial  reports  are  reviewed  by 
a  financial  analyst.   This  review  focuses  on  a  comparison  of 
performance  against  budget  for  the  five  key  measures  —  sales, 
net  income,  total  assets,  total  employees,  and  capital 
expenditures.   Trouble  spots  or  developing  trends  are  detected 
The  written  portions  of  the  reports  are  also  carefully 
reviewed. 

Although  revisions  of  the  forecasts  are  permitted, 
if  the  planned  objectives  are  not  met  the  situation  is  con- 
sidered serious. 

Guidance  is  available  from  specialists  or  the  product- 
line  managers  for  unit  managers  who  request  help  with  their 
operations. 

Although  the  comprehensive  reporting  and  control 
system  makes  it  appear  that  ITT  is  a  highly  centralized 
organization,  the  managements  of  the  various  operating  units 
actually  have  considerable  autonomy. 
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As  can  be  seen,  the  Business  Plan  of  ITT  has  a  number 
of  similarities  to,  and  a  few  differences  from,  the  PPBS  cycle 
used  in  DOD . 

A  similar  structure  and  process  is  followed.   The 
private  company's  regional  and  corporate  headquarters  can  be 
compared  to  DON's  major  claimant  and  Washington  headquarters 
staffs.   In  both  systems,  objectives  are  set  after  a  period 
of  negotiations.   Each  organization  establishes  budgets  for 
individual  units,  as  well  as  functional  programs.   Each 
organization  requires  justification  for  funding  requests  and 
each  budget  goes  through  an  elaborate  approval  process.   The 
Business  Plan  serves  as  the  basis  for  a  unit's  budget;  the 
POM  provides  a  basis  for  the  military  budget.   Both  sectors 
have  a  reporting  system,  but  the  one  presented  in  the  case 
is  more  extensive.   In  both  situations,  the  budgeting  sys- 
tem implies  a  highly  centralized  organization  but  in  fact, 
most  of  the  individual  units  are  quite  autonomous. 

Differences  between  these  two  systems  include:   The 
PPBS  system  must  work  through  many  more  layers  --  the 
President,  Congress,  DOD,  Navy,  and  finally  the  individual 
activity  —  and  in  a  political  atmosphere,  making  control 
more  complicated;  the  military  does  not  use  the  budget  as 
the  primary  standard  for  evaluating  the  performance  of  its 
managers,  but  focuses,  instead,  on  the  level  of  mission/ 
program  attainment  —  a  subjective  measure;  the  military 
budget  is  more  amenable  to  adjustment  than  a  unit's  Business 
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Plan;  the  military  service  does  not  plan  as  carefully  for 
under-or  over-budget  possibilities;  nor  does  the  military 
budget  address  management  plans. 

Some  of  these  differences  could  be  adapted  for  federal 
government  use. 

ITT's  Business  Plan  presents  a  concrete  example 
demonstrating  a  Planning  (what  is  to  be  done)  and  Control 
system  (how  it  is  to  be  done) .   Elements  of  strategic  plan- 
ning, management  control,  and  operational  control  can  be 
found  in  the  design.   And  it  is  clear  that  money  is  the 
common  denominator  among  the  heterogeneous  inputs  and  outputs 
of  the  individual  units. 

The  focus  is  on  management  control.   The  management 
accounting  information  that  is  gathered  provides  management 
data  which  assures  managers  that  resources  obtained  are  used 
effectively  and  efficiently  in  the  accomplishment  of  the 
unit's  objectives. 

When  performance  is  reviewed,  a  comparison  is  made 
of  budget  figures  with  actual  figures  but  the  written  por- 
tions (nonquantif iable  and  nonmonetary  data)  of  the  reports 
are  also  carefully  reviewed.   Thus,  rigid  conformance  to  plan 
is  not  the  only  standard  of  measurement  since  within  the 
management  control  system,  administrative  and  accounting 
information  are  both  considered. 
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VII.   CONCLUSIONS  AND  RECOMMENDATIONS 

A.  INTRODUCTION 

The  definition/  objectives,  and  concepts  of  internal  con- 
trol in  common  use  today  reflect  the  specialized  needs  of  the 
independent  auditor. 

There  is  little  material  adapting  the  existing  writings  to 
the  broader  needs  of  managers  who  require  a  focus  on  all  sys- 
tems, not  just  those  which  provide  financial  information. 

This  section  will  discuss  some  pertinent  comments  of  the 
Special  Advisory  Committee  on  Internal  Accounting  Control  that 
are  directed  to  private  sector  managers'  concerns  but  are 
equally  applicable  to  the  public  sector;  then  specific  con- 
siderations and  recommendations  for  the  public  sector  will  be 
offered;  finally  a  brief  concluding  statement  is  made. 

B .  REMARKS 

As  the  Special  Advisory  Committee  on  Internal  Accounting 

Control  commented  in  1979: 

Management  is  necessarily  concerned  about  all  of  the  con- 
trols contemplated  in  the  1949  definition  of  'internal 
control'  ...  controls  that  help  to  promote  efficient  and 
effective  operations  have  been,  and  will  continue  to  be, 
of  vital  importance  to  management.   Also  ...  administra- 
tive controls  may  have  a  bearing  on  the  selection  and 
effectiveness  of  an  (organization's)  accounting  control 
procedures  and  techniques  . . .  administrative  and  operating 
procedures  focusing  upon  specific  business  activities  often 
complement  accounting  control  procedures  ...  as  business 
transactions  and  the  procedures  necessary  to  execute  them 
become  more  complex,  the  difficulty  of  distinguishing  be- 
tween accounting  and  administrative  controls  is  increased. 
[Ref.  52] 
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Thus  managements'  interests  go  beyond  the  confines  of  the 
narrow  legal  interpretation  of  the  FCPA  or  the  FMFIA  to 
include  all  controls.   As  Grady  stated  in  1957  "...  there 
are  many  endeavors  wherein  a  broader  concept  of  responsibility 
results  in  a  lesser  risk  ..."   Since  his  statement  was  made, 
events  in  both  private  and  public  sectors  have  demonstrated 
the  shortcomings  of  the  narrow  application  of  internal  account- 
ing controls. 

A  further  comment  of  the  Special  Advisory  Committee  which 
is  equally  adaptable  to  private  and  public  organizations  states 

The  wide  range  in  the  size  of  these  (organizations) ,  in 
their  operating  styles,  in  the  complexity  of  their  trans- 
actions, in  the  diversity  of  their  products  (programs)  and 
services,  and  in  the  geographical  dispersion  of  their 
operations  clearly  makes  it  impossible  to  enumerate  specific 
controls  that  will  answer  the  needs  of  all  (organizations) . 
[Ref.  53] 

Thus,  since  internal  control  must  be  situation  specific, 
it  has  created  difficulty  in  the  public  sector  in  the  coor- 
dination and  summarization  of  reports  and  certifications 
throughout  organization  structures.   Similar  potential  prob- 
lems exist  in  the  corporate  environment  as  well,  but  private 
sector  managers  are  not  currently  required  to  report  on  the 
state  of  their  internal  control  in  quite  as  comprehensive  a 
manner  as  public  sector  executives  do. 

Other  statements  of  the  Report  require  consideration  by 
the  spectrum  of  managers: 


136 


Control  procedures  and  techniques  have  evolved  . . . 
based  on  the  judgments  of  individual  managements  of 
their  necessity  and  usefulness  in  specific 
circumstances . 

Subjective  knowledge,  experience,  specific  industry 
(programs)  and  business  conditions,  management  style, 
cost-benefit  judgments  . . .  affect  the  selection  of 
appropriate  control  procedures  and  techniques  . . . 
there  is  a  necessary  element  of  subjectivity  inherent 
in  an  evaluation  by  management  of  internal  ...  control. 

...  there  is  not  sufficient  empirical  knowledge  of  how 
extensively  control  procedures  and  techniques  are  em- 
ployed ...  the  lack  of  knowledge  of  what  (is)  neces- 
sary for  purposes  of  effective  internal  . . .  control 
further  complicates  the  task  of  evaluation. 

(organization)  do  not  have  a  comprehensive  theoretical 
model  to  use  in  making  informed,  supportable  judgments 
on  the  cost-benefit  decisions  implicit  in  developing 
their  ...  procedures  and  techniques.  [Ref.  54] 

These  comments  restate  the  themes  that  internal  control  is 
situation  specific  and  that  subjective  knowledge  and  profes- 
sional judgment  are  required  in  the  establishment  and  mainten- 
ance of  a  proper  system. 

C.   PUBLIC  SECTOR  CONSIDERATIONS 

The  following  comments  are  presented  specifically  for  public 

sector  managers1  consideration: 

That  the  agencies  directing  the  implementation  of  the 
internal  control  program  within  the  federal  government 
will  recognize  the  value  of  emphasizing  a  management 
control  framework  which  promotes  the  accomplishment  of 
organizational  goals  and  objectives;  and  within  which 
administrative  controls  promote  program  and  operational 
effectiveness  and  efficiency  and  support  managerial 
policies,  and  accounting  controls  safeguard  assets  and 
provide  accurate,  reliable  financial  data. 
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The  support  of  senior  line  managers  is  critical  and 
should  be  gained  with  the  focus  described  above  since 
this  broader  concept  is  the  only  meaningful  way  in 
which  internal  control  can  be  related  to  such  managers' 
responsibilities  and  interests  in  accomplishing  the 
goals  and  objectives  of  the  organization.   A  narrow 
focus  on  internal  accounting  control,  aiming  to  avoid 
legal  problems,  will  not  encompass  these  managers' 
wider  concerns . 

Once  this  broader  focus  is  cemented,  training  courses 
should  be  established  which  support  this  direction 
and  give  a  more  refined  set  of  guidelines  for  the 
establishment  and  review  of  internal  control  systems 
than  are  currently  available.   The  Arthur  Anderson  & 
Company  approach  mentioned  previously  should  be  a 
useful  beginning  because  of  the  inclusive  nature  of 
their  program. 

More  research  into  the  state  of  the  art  concerning 
systems  of  internal  control  with  an  emphasis  on  the 
concerns  of  managers  is  needed.   Lessons  learned  could 
be  presented  in  case  study  format  so  that  organiza- 
tions could  easily  adapt  useful  ideas  to  their  unique 
situations.   These  same  case  studies  could  be  useful 
in  the  aforementioned  training  courses. 

Since  most  control  measures  are  based  in  large  part 
on  the  fact  that  human  beings  make  mistakes  and  often 
do  not  react  to  problems  by  undertaking  adequate  and 
prompt  corrective  action,  the  more  qualified  employees 
are,  the  more  they  will  perceive  deviations  from  plans 
and  take  timely  action  to  prevent  them.   The  most 
direct  form  of  all  control  is  to  take  steps  to  ensure 
the  high  quality  of  employees,  commensurate  with  their 
responsibilities  and  at  reasonable  cost. 

A  large  measure  of  professional  judgment  is  required 
to  maintain  and  evaluate  a  dynamic  internal  control 
system. 

Some  thought  should  be  given  to  the  documentation  of 
internal  controls  in  common  management/administrative 
areas  by  the  cognizant  organizations  to  avoid  the 
redundant  effort  otherwise  required  by  each  individual 
activity. 
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D.   CONCLUSION 

It  is  recognized  that  the  internal  control  concept  is  in 
a  state  of  transition  in  the  public  sector.   Even  as  organiza- 
tions  struggle  to  establish  systems  based  on  the  broad 
definition,  OMB  and  DOD  are  narrowing  the  scope  to  internal 
accounting  control  to  meet  the  FMFIA  objectives.   This  shift 
can  only  add  to  the  confusion  of  implementing  a  little  under- 
stood program.   However,  this  narrowing  does  make  it  easier 
to  assess  internal  control  by  looking  at  information  that  is 
readily  quantifiable  and  innovative  approaches,  such  as  the 
Burns  System,  can  be  useful  here.   Such  an  approach  fails  to 
consider  management's  broader  range  of  responsibility  for 
accomplishing  its  programs  and  operational  activities  ef- 
ficiently and  effectively  within  prescribed  policies,  as  well 
as  safeguarding  its  assets  and  maintaining  accurate,  reliable 
accounting  data. 
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